ldap/ldif/template-dse.ldif.in | 5 ldap/schema/01core389.ldif | 13 ldap/servers/slapd/add.c | 5 ldap/servers/slapd/auditlog.c | 320 ++++++++----- ldap/servers/slapd/daemon.c | 12 ldap/servers/slapd/delete.c | 5 ldap/servers/slapd/libglobs.c | 202 +++++++- ldap/servers/slapd/log.c | 953 ++++++++++++++++++++++++++++++++++------ ldap/servers/slapd/log.h | 31 + ldap/servers/slapd/modify.c | 5 ldap/servers/slapd/modrdn.c | 6 ldap/servers/slapd/proto-slap.h | 14 ldap/servers/slapd/slap.h | 35 + 13 files changed, 1353 insertions(+), 253 deletions(-)

New commits: commit 5420e154aaf08cbf41c3c233b0d71c289b85b0e8 Author: William Brown firstyear@redhat.com Date: Mon Nov 9 14:06:17 2015 +1000

Ticket 48145 - RFE Add log file for rejected changes https://fedorahosted.org/389/ticket/48145 http://www.port389.org/docs/389ds/design/audit_improvement.html

Bug Description: Add log file for rejected changes: This will help with debug third party and other applications that are failing to connect to or work correctly with ldap servers.

Fix Description: The bulk of this code is duplication of existing audit log code. The remainder that is new is configuration items in schema, an update to the template dse.ldif for installation, hooking in add.c, delete.c, modify.c and modrdn.c. Finally, we extract the return code in write_auditfail_log_entry and insert this to the fail log.

You can enable this with:

cn=config nsslapd-auditfaillog-logging-enabled: on

The auditfail log is:

var/log/dirsrv/slapd-%instance%/auditfail

And contains entries such as:

time: 20151111152800 dn: uid=test,dc=example,dc=com result: 65 changetype: modify replace: objectClass objectClass: account objectClass: posixGroup objectClass: simpleSecurityObject objectClass: top -

Note the result maps to the ldap result code, in this case 65 == 0x41 LDAP_OBJECT_CLASS_VIOLATION 0x41

Author: wibrown

Review by: mreynolds, nhosoi (Thanks!)

diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in index 6acbfae..a25295b 100644 --- a/ldap/ldif/template-dse.ldif.in +++ b/ldap/ldif/template-dse.ldif.in @@ -52,6 +52,11 @@ nsslapd-auditlog-mode: 600 nsslapd-auditlog-maxlogsize: 100 nsslapd-auditlog-logrotationtime: 1 nsslapd-auditlog-logrotationtimeunit: day +nsslapd-auditfaillog: %log_dir%/auditfail +nsslapd-auditfaillog-mode: 600 +nsslapd-auditfaillog-maxlogsize: 100 +nsslapd-auditfaillog-logrotationtime: 1 +nsslapd-auditfaillog-logrotationtimeunit: day nsslapd-rootdn: %rootdn% nsslapd-rootpw: %ds_passwd% nsslapd-maxdescriptors: 1024 diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif index aebdb5a..42af40d 100644 --- a/ldap/schema/01core389.ldif +++ b/ldap/schema/01core389.ldif @@ -278,6 +278,19 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2311 NAME 'nsds5ReplicaFlowControlPause' attributeTypes: ( 2.16.840.1.113730.3.1.2313 NAME 'nsslapd-changelogtrim-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2314 NAME 'nsslapd-changelogcompactdb-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2315 NAME 'nsDS5ReplicaWaitForAsyncResults' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2316 NAME 'nsslapd-auditfaillog-maxlogsize' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2317 NAME 'nsslapd-auditfaillog-logrotationsync-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2318 NAME 'nsslapd-auditfaillog-logrotationsynchour' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2319 NAME 'nsslapd-auditfaillog-logrotationtime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2320 NAME 'nsslapd-auditfaillog-logrotationtimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2321 NAME 'nsslapd-auditfaillog-logmaxdiskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2322 NAME 'nsslapd-auditfaillog-logminfreediskspace' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2323 NAME 'nsslapd-auditfaillog-logexpirationtime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2324 NAME 'nsslapd-auditfaillog-logexpirationtimeunit' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2325 NAME 'nsslapd-auditfaillog-logging-enabled' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2326 NAME 'nsslapd-auditfaillog-logging-hide-unhashed-pw' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2327 NAME 'nsslapd-auditfaillog' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2328 NAME 'nsslapd-auditfaillog-list' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) # # objectclasses # diff --git a/ldap/servers/slapd/add.c b/ldap/servers/slapd/add.c index 31012a2..5e50025 100644 --- a/ldap/servers/slapd/add.c +++ b/ldap/servers/slapd/add.c @@ -753,6 +753,11 @@ static void op_shared_add (Slapi_PBlock *pb) operation_out_of_disk_space(); goto done; } + /* If the disk is full we don't want to make it worse ... */ + if (operation_is_flag_set(operation,OP_FLAG_ACTION_LOG_AUDIT)) + { + write_auditfail_log_entry(pb); /* Record the operation in the audit log */ + } } } else diff --git a/ldap/servers/slapd/auditlog.c b/ldap/servers/slapd/auditlog.c index 69019be..2ddfad0 100644 --- a/ldap/servers/slapd/auditlog.c +++ b/ldap/servers/slapd/auditlog.c @@ -26,10 +26,12 @@ char *attr_changetype = ATTR_CHANGETYPE; char *attr_newrdn = ATTR_NEWRDN; char *attr_deleteoldrdn = ATTR_DELETEOLDRDN; char *attr_modifiersname = ATTR_MODIFIERSNAME; -static int hide_unhashed_pw = 1; + +static int audit_hide_unhashed_pw = 1; +static int auditfail_hide_unhashed_pw = 1;

/* Forward Declarations */ -static void write_audit_file( int optype, const char *dn, void *change, int flag, time_t curtime ); +static void write_audit_file(int logtype, int optype, const char *dn, void *change, int flag, time_t curtime, int rc );

void write_audit_log_entry( Slapi_PBlock *pb ) @@ -76,9 +78,60 @@ write_audit_log_entry( Slapi_PBlock *pb ) curtime = current_time(); /* log the raw, unnormalized DN */ dn = slapi_sdn_get_udn(sdn); - write_audit_file( operation_get_type(op), dn, change, flag, curtime ); + write_audit_file(SLAPD_AUDIT_LOG, operation_get_type(op), dn, change, flag, curtime, 0); }

+void +write_auditfail_log_entry( Slapi_PBlock *pb ) +{ + time_t curtime; + Slapi_DN *sdn; + const char *dn; + void *change; + int flag = 0; + Operation *op; + int pbrc = 0; + + /* if the audit log is not enabled, just skip all of + this stuff */ + if (!config_get_auditfaillog_logging_enabled()) { + return; + } + + slapi_pblock_get( pb, SLAPI_OPERATION, &op ); + slapi_pblock_get( pb, SLAPI_TARGET_SDN, &sdn ); + + slapi_pblock_get( pb, SLAPI_RESULT_CODE, &pbrc ); + + switch ( operation_get_type(op) ) + { + case SLAPI_OPERATION_MODIFY: + slapi_pblock_get( pb, SLAPI_MODIFY_MODS, &change ); + break; + case SLAPI_OPERATION_ADD: + slapi_pblock_get( pb, SLAPI_ADD_ENTRY, &change ); + break; + case SLAPI_OPERATION_DELETE: + { + char * deleterDN = NULL; + slapi_pblock_get(pb, SLAPI_REQUESTOR_DN, &deleterDN); + change = deleterDN; + } + break; + case SLAPI_OPERATION_MODDN: + /* newrdn: change is just for logging -- case does not matter. */ + slapi_pblock_get( pb, SLAPI_MODRDN_NEWRDN, &change ); + slapi_pblock_get( pb, SLAPI_MODRDN_DELOLDRDN, &flag ); + break; + default: + return; /* Unsupported operation type. */ + } + curtime = current_time(); + /* log the raw, unnormalized DN */ + dn = slapi_sdn_get_udn(sdn); + /* If we are combined */ + write_audit_file(SLAPD_AUDITFAIL_LOG, operation_get_type(op), dn, change, flag, curtime, pbrc); +}

/* @@ -90,139 +143,174 @@ write_audit_log_entry( Slapi_PBlock *pb ) * For a delete operation, may contain the modifier's DN. * flag - only used by modrdn operations - value of deleteoldrdn flag * curtime - the current time + * rc - The ldap result code. Used in conjunction with auditfail * Returns: nothing */ static void write_audit_file( - int optype, - const char *dn, - void *change, - int flag, - time_t curtime + int logtype, + int optype, + const char *dn, + void *change, + int flag, + time_t curtime, + int rc ) { - LDAPMod **mods; - Slapi_Entry *e; - char *newrdn, *tmp, *tmpsave; - int len, i, j; - char *timestr; - lenstr *l; + LDAPMod **mods; + Slapi_Entry *e; + char *newrdn, *tmp, *tmpsave; + int len, i, j; + char *timestr; + char *rcstr; + lenstr *l;

l = lenstr_new();

addlenstr( l, "time: " ); timestr = format_localTime( curtime ); addlenstr( l, timestr ); - slapi_ch_free((void **) &timestr ); + slapi_ch_free_string(&timestr); addlenstr( l, "\n" ); addlenstr( l, "dn: " ); addlenstr( l, dn ); addlenstr( l, "\n" );

+ addlenstr( l, "result: " ); + rcstr = slapi_ch_smprintf("%d", rc); + addlenstr( l, rcstr ); + slapi_ch_free_string(&rcstr); + addlenstr( l, "\n" ); + + switch ( optype ) - { + { case SLAPI_OPERATION_MODIFY: - addlenstr( l, attr_changetype ); - addlenstr( l, ": modify\n" ); - mods = change; - for ( j = 0; (mods != NULL) && (mods[j] != NULL); j++ ) - { - int operationtype= mods[j]->mod_op & ~LDAP_MOD_BVALUES; - - if((strcmp(mods[j]->mod_type, PSEUDO_ATTR_UNHASHEDUSERPASSWORD) == 0) && hide_unhashed_pw){ - continue; - } - switch ( operationtype ) - { - case LDAP_MOD_ADD: - addlenstr( l, "add: " ); - addlenstr( l, mods[j]->mod_type ); - addlenstr( l, "\n" ); - break; - - case LDAP_MOD_DELETE: - addlenstr( l, "delete: " ); - addlenstr( l, mods[j]->mod_type ); - addlenstr( l, "\n" ); - break; - - case LDAP_MOD_REPLACE: - addlenstr( l, "replace: " ); - addlenstr( l, mods[j]->mod_type ); - addlenstr( l, "\n" ); - break; - - default: - operationtype= LDAP_MOD_IGNORE; - break; - } - if(operationtype!=LDAP_MOD_IGNORE) - { - for ( i = 0; mods[j]->mod_bvalues != NULL && mods[j]->mod_bvalues[i] != NULL; i++ ) - { - char *buf, *bufp; - len = strlen( mods[j]->mod_type ); - len = LDIF_SIZE_NEEDED( len, mods[j]->mod_bvalues[i]->bv_len ) + 1; - buf = slapi_ch_malloc( len ); - bufp = buf; - slapi_ldif_put_type_and_value_with_options( &bufp, mods[j]->mod_type, - mods[j]->mod_bvalues[i]->bv_val, - mods[j]->mod_bvalues[i]->bv_len, 0 ); - *bufp = '\0'; - addlenstr( l, buf ); - slapi_ch_free( (void**)&buf ); - } - } - addlenstr( l, "-\n" ); - } - break; + addlenstr( l, attr_changetype ); + addlenstr( l, ": modify\n" ); + mods = change; + for ( j = 0; (mods != NULL) && (mods[j] != NULL); j++ ) + { + int operationtype= mods[j]->mod_op & ~LDAP_MOD_BVALUES; + + if(strcmp(mods[j]->mod_type, PSEUDO_ATTR_UNHASHEDUSERPASSWORD) == 0){ + switch (logtype) + { + case SLAPD_AUDIT_LOG: + if (audit_hide_unhashed_pw != 0) { + continue; + } + break; + case SLAPD_AUDITFAIL_LOG: + if (auditfail_hide_unhashed_pw != 0) { + continue; + } + break; + } + } + switch ( operationtype ) + { + case LDAP_MOD_ADD: + addlenstr( l, "add: " ); + addlenstr( l, mods[j]->mod_type ); + addlenstr( l, "\n" ); + break; + + case LDAP_MOD_DELETE: + addlenstr( l, "delete: " ); + addlenstr( l, mods[j]->mod_type ); + addlenstr( l, "\n" ); + break; + + case LDAP_MOD_REPLACE: + addlenstr( l, "replace: " ); + addlenstr( l, mods[j]->mod_type ); + addlenstr( l, "\n" ); + break; + + default: + operationtype= LDAP_MOD_IGNORE; + break; + } + if(operationtype!=LDAP_MOD_IGNORE) + { + for ( i = 0; mods[j]->mod_bvalues != NULL && mods[j]->mod_bvalues[i] != NULL; i++ ) + { + char *buf, *bufp; + len = strlen( mods[j]->mod_type ); + len = LDIF_SIZE_NEEDED( len, mods[j]->mod_bvalues[i]->bv_len ) + 1; + buf = slapi_ch_malloc( len ); + bufp = buf; + slapi_ldif_put_type_and_value_with_options( &bufp, mods[j]->mod_type, + mods[j]->mod_bvalues[i]->bv_val, + mods[j]->mod_bvalues[i]->bv_len, 0 ); + *bufp = '\0'; + addlenstr( l, buf ); + slapi_ch_free( (void**)&buf ); + } + } + addlenstr( l, "-\n" ); + } + break;

case SLAPI_OPERATION_ADD: - e = change; - addlenstr( l, attr_changetype ); - addlenstr( l, ": add\n" ); - tmp = slapi_entry2str( e, &len ); - tmpsave = tmp; - while (( tmp = strchr( tmp, '\n' )) != NULL ) - { - tmp++; - if ( !ldap_utf8isspace( tmp )) - { - break; - } - } - addlenstr( l, tmp ); - slapi_ch_free((void**)&tmpsave ); - break; + e = change; + addlenstr( l, attr_changetype ); + addlenstr( l, ": add\n" ); + tmp = slapi_entry2str( e, &len ); + tmpsave = tmp; + while (( tmp = strchr( tmp, '\n' )) != NULL ) + { + tmp++; + if ( !ldap_utf8isspace( tmp )) + { + break; + } + } + addlenstr( l, tmp ); + slapi_ch_free((void**)&tmpsave ); + break;

case SLAPI_OPERATION_DELETE: - tmp = change; - addlenstr( l, attr_changetype ); - addlenstr( l, ": delete\n" ); - if (tmp && tmp[0]) { - addlenstr( l, attr_modifiersname ); - addlenstr( l, ": "); - addlenstr( l, tmp); - addlenstr( l, "\n"); - } - break; + tmp = change; + addlenstr( l, attr_changetype ); + addlenstr( l, ": delete\n" ); + if (tmp && tmp[0]) { + addlenstr( l, attr_modifiersname ); + addlenstr( l, ": "); + addlenstr( l, tmp); + addlenstr( l, "\n"); + } + break;

case SLAPI_OPERATION_MODDN: - newrdn = change; - addlenstr( l, attr_changetype ); - addlenstr( l, ": modrdn\n" ); - addlenstr( l, attr_newrdn ); - addlenstr( l, ": " ); - addlenstr( l, newrdn ); - addlenstr( l, "\n" ); - addlenstr( l, attr_deleteoldrdn ); - addlenstr( l, ": " ); - addlenstr( l, flag ? "1" : "0" ); - addlenstr( l, "\n" ); + newrdn = change; + addlenstr( l, attr_changetype ); + addlenstr( l, ": modrdn\n" ); + addlenstr( l, attr_newrdn ); + addlenstr( l, ": " ); + addlenstr( l, newrdn ); + addlenstr( l, "\n" ); + addlenstr( l, attr_deleteoldrdn ); + addlenstr( l, ": " ); + addlenstr( l, flag ? "1" : "0" ); + addlenstr( l, "\n" ); } addlenstr( l, "\n" );

- slapd_log_audit_proc (l->ls_buf, l->ls_len); + switch (logtype) + { + case SLAPD_AUDIT_LOG: + slapd_log_audit_proc (l->ls_buf, l->ls_len); + break; + case SLAPD_AUDITFAIL_LOG: + slapd_log_auditfail_proc (l->ls_buf, l->ls_len); + break; + default: + /* Unsupported log type, we should make some noise */ + LDAPDebug1Arg(LDAP_DEBUG_ANY, "write_audit_log: Invalid log type specified. logtype %d\n", logtype); + break; + }

lenstr_free( &l ); } @@ -230,11 +318,23 @@ write_audit_file( void auditlog_hide_unhashed_pw() { - hide_unhashed_pw = 1; + audit_hide_unhashed_pw = 1; }

void auditlog_expose_unhashed_pw() { - hide_unhashed_pw = 0; + audit_hide_unhashed_pw = 0; +} + +void +auditfaillog_hide_unhashed_pw() +{ + auditfail_hide_unhashed_pw = 1; +} + +void +auditfaillog_expose_unhashed_pw() +{ + auditfail_hide_unhashed_pw = 0; } diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index 5d70647..8413937 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -357,6 +357,7 @@ disk_mon_get_dirs(char ***list, int logs_critical){ disk_mon_add_dir(list, config->accesslog); disk_mon_add_dir(list, config->errorlog); disk_mon_add_dir(list, config->auditlog); + disk_mon_add_dir(list, config->auditfaillog); CFG_UNLOCK_READ(config);

be = slapi_get_first_backend (&cookie); @@ -456,6 +457,7 @@ disk_monitoring_thread(void *nothing) int verbose_logging = 0; int using_accesslog = 0; int using_auditlog = 0; + int using_auditfaillog = 0; int logs_disabled = 0; int grace_period = 0; int first_pass = 1; @@ -488,6 +490,9 @@ disk_monitoring_thread(void *nothing) if(config_get_auditlog_logging_enabled()){ using_auditlog = 1; } + if(config_get_auditfaillog_logging_enabled()){ + using_auditfaillog = 1; + } if(config_get_accesslog_logging_enabled()){ using_accesslog = 1; } @@ -513,6 +518,9 @@ disk_monitoring_thread(void *nothing) if(using_auditlog){ config_set_auditlog_enabled(LOGGING_ON); } + if(using_auditfaillog){ + config_set_auditfaillog_enabled(LOGGING_ON); + } } else { LDAPDebug(LDAP_DEBUG_ANY, "Disk space is now within acceptable levels.\n",0,0,0); } @@ -557,6 +565,7 @@ disk_monitoring_thread(void *nothing) "disabling access and audit logging.\n", dirstr, (disk_space / 1024), 0); config_set_accesslog_enabled(LOGGING_OFF); config_set_auditlog_enabled(LOGGING_OFF); + config_set_auditfaillog_enabled(LOGGING_OFF); logs_disabled = 1; continue; } @@ -617,6 +626,9 @@ disk_monitoring_thread(void *nothing) if(logs_disabled && using_auditlog){ config_set_auditlog_enabled(LOGGING_ON); } + if(logs_disabled && using_auditfaillog){ + config_set_auditfaillog_enabled(LOGGING_ON); + } deleted_rotated_logs = 0; passed_threshold = 0; logs_disabled = 0; diff --git a/ldap/servers/slapd/delete.c b/ldap/servers/slapd/delete.c index b51aea5..d3c4d8a 100644 --- a/ldap/servers/slapd/delete.c +++ b/ldap/servers/slapd/delete.c @@ -351,6 +351,11 @@ static void op_shared_delete (Slapi_PBlock *pb) operation_out_of_disk_space(); goto free_and_return; } + /* If the disk is full we don't want to make it worse ... */ + if (operation_is_flag_set(operation,OP_FLAG_ACTION_LOG_AUDIT)) + { + write_auditfail_log_entry(pb); /* Record the operation in the audit log */ + } } }

diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index fde3885..2296720 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -152,12 +152,15 @@ static int invalid_sasl_mech(char *str); #define INIT_ACCESSLOG_MODE "600" #define INIT_ERRORLOG_MODE "600" #define INIT_AUDITLOG_MODE "600" +#define INIT_AUDITFAILLOG_MODE "600" #define INIT_ACCESSLOG_ROTATIONUNIT "day" #define INIT_ERRORLOG_ROTATIONUNIT "week" #define INIT_AUDITLOG_ROTATIONUNIT "week" +#define INIT_AUDITFAILLOG_ROTATIONUNIT "week" #define INIT_ACCESSLOG_EXPTIMEUNIT "month" #define INIT_ERRORLOG_EXPTIMEUNIT "month" #define INIT_AUDITLOG_EXPTIMEUNIT "month" +#define INIT_AUDITFAILLOG_EXPTIMEUNIT "month" #define DEFAULT_DIRECTORY_MANAGER "cn=Directory Manager" #define DEFAULT_UIDNUM_TYPE "uidNumber" #define DEFAULT_GIDNUM_TYPE "gidNumber" @@ -171,11 +174,14 @@ static int invalid_sasl_mech(char *str); slapi_onoff_t init_accesslog_rotationsync_enabled; slapi_onoff_t init_errorlog_rotationsync_enabled; slapi_onoff_t init_auditlog_rotationsync_enabled; +slapi_onoff_t init_auditfaillog_rotationsync_enabled; slapi_onoff_t init_accesslog_logging_enabled; slapi_onoff_t init_accesslogbuffering; slapi_onoff_t init_errorlog_logging_enabled; slapi_onoff_t init_auditlog_logging_enabled; slapi_onoff_t init_auditlog_logging_hide_unhashed_pw; +slapi_onoff_t init_auditfaillog_logging_enabled; +slapi_onoff_t init_auditfaillog_logging_hide_unhashed_pw; slapi_onoff_t init_csnlogging; slapi_onoff_t init_pw_unlock; slapi_onoff_t init_pw_must_change; @@ -1105,8 +1111,73 @@ static struct config_get_and_set { NULL, 0, (void**)&global_slapdFrontendConfig.mempool_maxfreelist, CONFIG_INT, (ConfigGetFunc)config_get_mempool_maxfreelist, - DEFAULT_MEMPOOL_MAXFREELIST} + DEFAULT_MEMPOOL_MAXFREELIST}, #endif /* MEMPOOL_EXPERIMENTAL */ + /* Audit fail log configuration */ + {CONFIG_AUDITFAILLOG_MODE_ATTRIBUTE, NULL, + log_set_mode, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_mode, + CONFIG_STRING, NULL, INIT_AUDITFAILLOG_MODE}, + {CONFIG_AUDITFAILLOG_LOGROTATIONSYNCENABLED_ATTRIBUTE, NULL, + log_set_rotationsync_enabled, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_rotationsync_enabled, + CONFIG_ON_OFF, NULL, &init_auditfaillog_rotationsync_enabled}, + {CONFIG_AUDITFAILLOG_LOGROTATIONSYNCHOUR_ATTRIBUTE, NULL, + log_set_rotationsynchour, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_rotationsynchour, + CONFIG_INT, NULL, DEFAULT_LOG_ROTATIONSYNCHOUR}, + {CONFIG_AUDITFAILLOG_LOGROTATIONSYNCMIN_ATTRIBUTE, NULL, + log_set_rotationsyncmin, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_rotationsyncmin, + CONFIG_INT, NULL, DEFAULT_LOG_ROTATIONSYNCMIN}, + {CONFIG_AUDITFAILLOG_LOGROTATIONTIME_ATTRIBUTE, NULL, + log_set_rotationtime, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_rotationtime, + CONFIG_INT, NULL, DEFAULT_LOG_ROTATIONTIME}, + {CONFIG_AUDITFAILLOG_MAXLOGDISKSPACE_ATTRIBUTE, NULL, + log_set_maxdiskspace, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_maxdiskspace, + CONFIG_INT, NULL, DEFAULT_LOG_MAXDISKSPACE}, + {CONFIG_AUDITFAILLOG_MAXLOGSIZE_ATTRIBUTE, NULL, + log_set_logsize, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_maxlogsize, + CONFIG_INT, NULL, DEFAULT_LOG_MAXLOGSIZE}, + {CONFIG_AUDITFAILLOG_LOGEXPIRATIONTIME_ATTRIBUTE, NULL, + log_set_expirationtime, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_exptime, + CONFIG_INT, NULL, DEFAULT_LOG_EXPTIME}, + {CONFIG_AUDITFAILLOG_MAXNUMOFLOGSPERDIR_ATTRIBUTE, NULL, + log_set_numlogsperdir, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_maxnumlogs, + CONFIG_INT, NULL, DEFAULT_LOG_MAXNUMLOGS}, + {CONFIG_AUDITFAILLOG_LIST_ATTRIBUTE, NULL, + NULL, 0, NULL, + CONFIG_CHARRAY, (ConfigGetFunc)config_get_auditfaillog_list, NULL}, + {CONFIG_AUDITFAILLOG_LOGGING_ENABLED_ATTRIBUTE, NULL, + log_set_logging, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_logging_enabled, + CONFIG_ON_OFF, NULL, &init_auditfaillog_logging_enabled}, + {CONFIG_AUDITFAILLOG_LOGGING_HIDE_UNHASHED_PW, config_set_auditfaillog_unhashed_pw, + NULL, 0, + (void**)&global_slapdFrontendConfig.auditfaillog_logging_hide_unhashed_pw, + CONFIG_ON_OFF, NULL, &init_auditfaillog_logging_hide_unhashed_pw}, + {CONFIG_AUDITFAILLOG_LOGEXPIRATIONTIMEUNIT_ATTRIBUTE, NULL, + log_set_expirationtimeunit, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_exptimeunit, + CONFIG_STRING_OR_UNKNOWN, NULL, INIT_AUDITFAILLOG_EXPTIMEUNIT}, + {CONFIG_AUDITFAILLOG_MINFREEDISKSPACE_ATTRIBUTE, NULL, + log_set_mindiskspace, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_minfreespace, + CONFIG_INT, NULL, DEFAULT_LOG_MINFREESPACE}, + {CONFIG_AUDITFAILLOG_LOGROTATIONTIMEUNIT_ATTRIBUTE, NULL, + log_set_rotationtimeunit, SLAPD_AUDITFAIL_LOG, + (void**)&global_slapdFrontendConfig.auditfaillog_rotationunit, + CONFIG_STRING_OR_UNKNOWN, NULL, INIT_AUDITFAILLOG_ROTATIONUNIT}, + {CONFIG_AUDITFAILFILE_ATTRIBUTE, config_set_auditfaillog, + NULL, 0, + (void**)&global_slapdFrontendConfig.auditfaillog, + CONFIG_STRING_OR_EMPTY, NULL, NULL/* deletion is not allowed */} + /* End audit fail log configuration */ };

/* @@ -1513,6 +1584,23 @@ FrontendConfig_init () { init_auditlog_logging_hide_unhashed_pw = cfg->auditlog_logging_hide_unhashed_pw = LDAP_ON;

+ init_auditfaillog_logging_enabled = cfg->auditfaillog_logging_enabled = LDAP_OFF; + cfg->auditfaillog_mode = slapi_ch_strdup(INIT_AUDITFAILLOG_MODE); + cfg->auditfaillog_maxnumlogs = 1; + cfg->auditfaillog_maxlogsize = 100; + cfg->auditfaillog_rotationtime = 1; + cfg->auditfaillog_rotationunit = slapi_ch_strdup(INIT_AUDITFAILLOG_ROTATIONUNIT); + init_auditfaillog_rotationsync_enabled = + cfg->auditfaillog_rotationsync_enabled = LDAP_OFF; + cfg->auditfaillog_rotationsynchour = 0; + cfg->auditfaillog_rotationsyncmin = 0; + cfg->auditfaillog_maxdiskspace = 100; + cfg->auditfaillog_minfreespace = 5; + cfg->auditfaillog_exptime = 1; + cfg->auditfaillog_exptimeunit = slapi_ch_strdup(INIT_AUDITFAILLOG_EXPTIMEUNIT); + init_auditfaillog_logging_hide_unhashed_pw = + cfg->auditfaillog_logging_hide_unhashed_pw = LDAP_ON; + init_entryusn_global = cfg->entryusn_global = LDAP_OFF; cfg->entryusn_import_init = slapi_ch_strdup(ENTRYUSN_IMPORT_INIT); cfg->allowed_to_delete_attrs = slapi_ch_strdup("passwordadmindn nsslapd-listenhost nsslapd-securelistenhost nsslapd-defaultnamingcontext"); @@ -1630,17 +1718,33 @@ get_entry_point( int ep_name, caddr_t *ep_addr ) int config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply) { - slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); - int retVal = LDAP_SUCCESS; + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS;

- retVal = config_set_onoff ( attrname, value, &(slapdFrontendConfig->auditlog_logging_hide_unhashed_pw), - errorbuf, apply); - if(strcasecmp(value,"on") == 0){ - auditlog_hide_unhashed_pw(); - } else { - auditlog_expose_unhashed_pw(); - } - return retVal; + retVal = config_set_onoff ( attrname, value, &(slapdFrontendConfig->auditlog_logging_hide_unhashed_pw), + errorbuf, apply); + if(strcasecmp(value,"on") == 0){ + auditlog_hide_unhashed_pw(); + } else { + auditlog_expose_unhashed_pw(); + } + return retVal; +} + +int +config_set_auditfaillog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply) +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS; + + retVal = config_set_onoff ( attrname, value, &(slapdFrontendConfig->auditfaillog_logging_hide_unhashed_pw), + errorbuf, apply); + if(strcasecmp(value,"on") == 0){ + auditfaillog_hide_unhashed_pw(); + } else { + auditfaillog_expose_unhashed_pw(); + } + return retVal; }

/* @@ -4157,6 +4261,31 @@ config_set_errorlog( const char *attrname, char *value, char *errorbuf, int appl

int config_set_auditlog( const char *attrname, char *value, char *errorbuf, int apply ) { + int retVal = LDAP_SUCCESS; + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + + if ( config_value_is_null( attrname, value, errorbuf, 1 )) { + return LDAP_OPERATIONS_ERROR; + } + + retVal = log_update_auditlogdir ( value, apply ); + + if ( retVal != LDAP_SUCCESS ) { + PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, + "Cannot open auditlog directory "%s"", value ); + } + + if ( apply ) { + CFG_LOCK_WRITE(slapdFrontendConfig); + slapi_ch_free ( (void **) &(slapdFrontendConfig->auditlog) ); + slapdFrontendConfig->auditlog = slapi_ch_strdup ( value ); + CFG_UNLOCK_WRITE(slapdFrontendConfig); + } + return retVal; +} + +int +config_set_auditfaillog( const char *attrname, char *value, char *errorbuf, int apply ) { int retVal = LDAP_SUCCESS; slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();

@@ -4164,17 +4293,17 @@ config_set_auditlog( const char *attrname, char *value, char *errorbuf, int appl return LDAP_OPERATIONS_ERROR; }

- retVal = log_update_auditlogdir ( value, apply ); + retVal = log_update_auditfaillogdir ( value, apply );

if ( retVal != LDAP_SUCCESS ) { PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, - "Cannot open auditlog directory "%s"", value ); + "Cannot open auditfaillog directory "%s"", value ); }

if ( apply ) { CFG_LOCK_WRITE(slapdFrontendConfig); - slapi_ch_free ( (void **) &(slapdFrontendConfig->auditlog) ); - slapdFrontendConfig->auditlog = slapi_ch_strdup ( value ); + slapi_ch_free ( (void **) &(slapdFrontendConfig->auditfaillog) ); + slapdFrontendConfig->auditfaillog = slapi_ch_strdup ( value ); CFG_UNLOCK_WRITE(slapdFrontendConfig); } return retVal; @@ -5514,6 +5643,18 @@ config_get_auditlog( ){ return retVal; }

+char * +config_get_auditfaillog( ){ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + char *retVal; + + CFG_LOCK_READ(slapdFrontendConfig); + retVal = config_copy_strval(slapdFrontendConfig->auditfaillog); + CFG_UNLOCK_READ(slapdFrontendConfig); + + return retVal; +} + long config_get_pw_maxage() { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); @@ -5589,6 +5730,16 @@ config_get_auditlog_logging_enabled(){ }

int +config_get_auditfaillog_logging_enabled(){ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal; + + retVal = (int)slapdFrontendConfig->auditfaillog_logging_enabled; + + return retVal; +} + +int config_get_accesslog_logging_enabled(){ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); int retVal; @@ -6428,6 +6579,12 @@ config_get_auditlog_list() return log_get_loglist(SLAPD_AUDIT_LOG); }

+char ** +config_get_auditfaillog_list() +{ + return log_get_loglist(SLAPD_AUDITFAIL_LOG); +} + int config_set_accesslogbuffering(const char *attrname, char *value, char *errorbuf, int apply) { @@ -7771,6 +7928,21 @@ config_set_auditlog_enabled(int value){ CFG_ONOFF_UNLOCK_WRITE(slapdFrontendConfig); }

+void +config_set_auditfaillog_enabled(int value){ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + char errorbuf[BUFSIZ]; + + CFG_ONOFF_LOCK_WRITE(slapdFrontendConfig); + slapdFrontendConfig->auditfaillog_logging_enabled = (int)value; + if(value){ + log_set_logging(CONFIG_AUDITFAILLOG_LOGGING_ENABLED_ATTRIBUTE, "on", SLAPD_AUDITFAIL_LOG, errorbuf, CONFIG_APPLY); + } else { + log_set_logging(CONFIG_AUDITFAILLOG_LOGGING_ENABLED_ATTRIBUTE, "off", SLAPD_AUDITFAIL_LOG, errorbuf, CONFIG_APPLY); + } + CFG_ONOFF_UNLOCK_WRITE(slapdFrontendConfig); +} + int config_set_maxsimplepaged_per_conn( const char *attrname, char *value, char *errorbuf, int apply ) { diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c index 78701c4..ef6e57b 100644 --- a/ldap/servers/slapd/log.c +++ b/ldap/servers/slapd/log.c @@ -77,13 +77,16 @@ static int slapi_log_map[] = { static int log__open_accesslogfile(int logfile_type, int locked); static int log__open_errorlogfile(int logfile_type, int locked); static int log__open_auditlogfile(int logfile_type, int locked); +static int log__open_auditfaillogfile(int logfile_type, int locked); static int log__needrotation(LOGFD fp, int logtype); static int log__delete_access_logfile(); static int log__delete_error_logfile(int locked); static int log__delete_audit_logfile(); +static int log__delete_auditfail_logfile(); static int log__access_rotationinfof(char *pathname); static int log__error_rotationinfof(char *pathname); static int log__audit_rotationinfof(char *pathname); +static int log__auditfail_rotationinfof(char *pathname); static int log__extract_logheader (FILE *fp, long *f_ctime, PRInt64 *f_size); static int log__check_prevlogs (FILE *fp, char *filename); static PRInt64 log__getfilesize(LOGFD fp); @@ -273,6 +276,33 @@ void g_log_init(int log_enabled) if ((loginfo.log_audit_rwlock =slapi_new_rwlock())== NULL ) { exit (-1); } + + /* AUDIT LOG */ + loginfo.log_auditfail_state = 0; + loginfo.log_auditfail_mode = SLAPD_DEFAULT_FILE_MODE; + loginfo.log_auditfail_maxnumlogs = 1; + loginfo.log_auditfail_maxlogsize = -1; + loginfo.log_auditfail_rotationsync_enabled = 0; + loginfo.log_auditfail_rotationsynchour = -1; + loginfo.log_auditfail_rotationsyncmin = -1; + loginfo.log_auditfail_rotationsyncclock = -1; + loginfo.log_auditfail_rotationtime = 1; /* default: 1 */ + loginfo.log_auditfail_rotationunit = LOG_UNIT_WEEKS; /* default: week */ + loginfo.log_auditfail_rotationtime_secs = 604800; /* default: 1 week */ + loginfo.log_auditfail_maxdiskspace = -1; + loginfo.log_auditfail_minfreespace = -1; + loginfo.log_auditfail_exptime = -1; /* default: -1 */ + loginfo.log_auditfail_exptimeunit = LOG_UNIT_WEEKS; /* default: week */ + loginfo.log_auditfail_exptime_secs = -1; /* default: -1 */ + loginfo.log_auditfail_ctime = 0L; + loginfo.log_auditfail_file = NULL; + loginfo.log_auditfailinfo_file = NULL; + loginfo.log_numof_auditfail_logs = 1; + loginfo.log_auditfail_fdes = NULL; + loginfo.log_auditfail_logchain = NULL; + if ((loginfo.log_auditfail_rwlock =slapi_new_rwlock())== NULL ) { + exit (-1); + } }

/****************************************************************************** @@ -342,6 +372,17 @@ log_set_logging(const char *attrname, char *value, int logtype, char *errorbuf, } LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + fe_cfg->auditfaillog_logging_enabled = v; + if (v) { + loginfo.log_auditfail_state |= LOGGING_ENABLED; + } + else { + loginfo.log_auditfail_state &= ~LOGGING_ENABLED; + } + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; } return LDAP_SUCCESS; @@ -580,6 +621,84 @@ log_update_auditlogdir(char *pathname, int apply) return rv; }

+/****************************************************************************** +* Tell me the audit fail log file name inc path +******************************************************************************/ +char * +g_get_auditfail_log() { + char *logfile = NULL; + + LOG_AUDITFAIL_LOCK_READ(); + if ( loginfo.log_auditfail_file) { + logfile = slapi_ch_strdup (loginfo.log_auditfail_file); + } + LOG_AUDITFAIL_UNLOCK_READ(); + + return logfile; +} +/****************************************************************************** +* Point to a new auditfail logdir +* +* Returns: +* LDAP_SUCCESS -- success +* LDAP_UNWILLING_TO_PERFORM -- when trying to open a invalid log file +* LDAP_LOCAL_ERRO -- some error +******************************************************************************/ +int +log_update_auditfaillogdir(char *pathname, int apply) +{ + int rv = LDAP_SUCCESS; + LOGFD fp; + + /* try to open the file, we may have a incorrect path */ + if (! LOG_OPEN_APPEND(fp, pathname, loginfo.log_auditfail_mode)) { + LDAPDebug(LDAP_DEBUG_ANY, "WARNING: can't open file %s. " + "errno %d (%s)\n", + pathname, errno, slapd_system_strerror(errno)); + /* stay with the current log file */ + return LDAP_UNWILLING_TO_PERFORM; + } + LOG_CLOSE(fp); + + /* skip the rest if we aren't doing this for real */ + if ( !apply ) { + return LDAP_SUCCESS; + } + + /* + ** The user has changed the audit log directory. That means we + ** need to start fresh. + */ + LOG_AUDITFAIL_LOCK_WRITE (); + if (loginfo.log_auditfail_fdes) { + LogFileInfo *logp, *d_logp; + LDAPDebug(LDAP_DEBUG_TRACE, + "LOGINFO:Closing the auditfail log file. " + "Moving to a new auditfail file (%s)\n", pathname,0,0); + + LOG_CLOSE(loginfo.log_auditfail_fdes); + loginfo.log_auditfail_fdes = 0; + loginfo.log_auditfail_ctime = 0; + logp = loginfo.log_auditfail_logchain; + while (logp) { + d_logp = logp; + logp = logp->l_next; + slapi_ch_free((void**)&d_logp); + } + loginfo.log_auditfail_logchain = NULL; + slapi_ch_free((void**)&loginfo.log_auditfail_file); + loginfo.log_auditfail_file = NULL; + loginfo.log_numof_auditfail_logs = 1; + } + + /* Now open the new auditlog */ + if ( auditfail_log_openf (pathname, 1 /* locked */)) { + rv = LDAP_LOCAL_ERROR; /* error: Unable to use the new dir */ + } + LOG_AUDITFAIL_UNLOCK_WRITE(); + return rv; +} + int log_set_mode (const char *attrname, char *value, int logtype, char *errorbuf, int apply) { @@ -667,7 +786,8 @@ log_set_numlogsperdir(const char *attrname, char *numlogs_str, int logtype, char

if ( logtype != SLAPD_ACCESS_LOG && logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { rv = LDAP_OPERATIONS_ERROR; PR_snprintf( returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid log type %d", attrname, logtype ); @@ -698,6 +818,12 @@ log_set_numlogsperdir(const char *attrname, char *numlogs_str, int logtype, char fe_cfg->auditlog_maxnumlogs = numlogs; LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + loginfo.log_auditfail_maxnumlogs = numlogs; + fe_cfg->auditfaillog_maxnumlogs = numlogs; + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; default: rv = LDAP_OPERATIONS_ERROR; LDAPDebug( LDAP_DEBUG_ANY, @@ -749,6 +875,10 @@ log_set_logsize(const char *attrname, char *logsize_str, int logtype, char *retu LOG_AUDIT_LOCK_WRITE( ); mdiskspace = loginfo.log_audit_maxdiskspace; break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + mdiskspace = loginfo.log_auditfail_maxdiskspace; + break; default: PR_snprintf( returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid logtype %d", attrname, logtype ); @@ -780,6 +910,13 @@ log_set_logsize(const char *attrname, char *logsize_str, int logtype, char *retu } LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + if (!rv && apply) { + loginfo.log_auditfail_maxlogsize = max_logsize; + fe_cfg->auditfaillog_maxlogsize = logsize; + } + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; default: rv = 1; } @@ -868,6 +1005,12 @@ log_set_rotationsync_enabled(const char *attrname, char *value, int logtype, cha loginfo.log_audit_rotationsync_enabled = v; LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + fe_cfg->auditfaillog_rotationsync_enabled = v; + loginfo.log_auditfail_rotationsync_enabled = v; + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; } return LDAP_SUCCESS; } @@ -881,7 +1024,8 @@ log_set_rotationsynchour(const char *attrname, char *rhour_str, int logtype, cha if ( logtype != SLAPD_ACCESS_LOG && logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { PR_snprintf( returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid log type: %d", attrname, logtype ); return LDAP_OPERATIONS_ERROR; @@ -919,6 +1063,13 @@ log_set_rotationsynchour(const char *attrname, char *rhour_str, int logtype, cha fe_cfg->auditlog_rotationsynchour = rhour; LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + loginfo.log_auditfail_rotationsynchour = rhour; + loginfo.log_auditfail_rotationsyncclock = log_get_rotationsyncclock( rhour, loginfo.log_auditfail_rotationsyncmin ); + fe_cfg->auditfaillog_rotationsynchour = rhour; + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; }

return rv; @@ -933,7 +1084,8 @@ log_set_rotationsyncmin(const char *attrname, char *rmin_str, int logtype, char if ( logtype != SLAPD_ACCESS_LOG && logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { PR_snprintf( returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid log type: %d", attrname, logtype ); return LDAP_OPERATIONS_ERROR; @@ -971,6 +1123,13 @@ log_set_rotationsyncmin(const char *attrname, char *rmin_str, int logtype, char loginfo.log_audit_rotationsyncclock = log_get_rotationsyncclock( loginfo.log_audit_rotationsynchour, rmin ); LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + loginfo.log_auditfail_rotationsyncmin = rmin; + fe_cfg->auditfaillog_rotationsyncmin = rmin; + loginfo.log_auditfail_rotationsyncclock = log_get_rotationsyncclock( loginfo.log_auditfail_rotationsynchour, rmin ); + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; }

return rv; @@ -993,7 +1152,8 @@ log_set_rotationtime(const char *attrname, char *rtime_str, int logtype, char *r if ( logtype != SLAPD_ACCESS_LOG && logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { PR_snprintf( returntext, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid log type: %d", attrname, logtype ); return LDAP_OPERATIONS_ERROR; @@ -1026,6 +1186,11 @@ log_set_rotationtime(const char *attrname, char *rtime_str, int logtype, char *r loginfo.log_audit_rotationtime = rtime; runit = loginfo.log_audit_rotationunit; break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + loginfo.log_auditfail_rotationtime = rtime; + runit = loginfo.log_auditfail_rotationunit; + break; }

/* find out the rotation unit we have se right now */ @@ -1064,6 +1229,11 @@ log_set_rotationtime(const char *attrname, char *rtime_str, int logtype, char *r loginfo.log_audit_rotationtime_secs = value; LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + fe_cfg->auditfaillog_rotationtime = rtime; + loginfo.log_auditfail_rotationtime_secs = value; + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; } return rv; } @@ -1082,92 +1252,104 @@ int log_set_rotationtimeunit(const char *attrname, char *runit, int logtype, cha slapdFrontendConfig_t *fe_cfg = getFrontendConfig();

if ( logtype != SLAPD_ACCESS_LOG && - logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { - PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, - "%s: invalid log type: %d", attrname, logtype ); - return LDAP_OPERATIONS_ERROR; + logtype != SLAPD_ERROR_LOG && + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { + PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, + "%s: invalid log type: %d", attrname, logtype ); + return LDAP_OPERATIONS_ERROR; }

if ( (strcasecmp(runit, "month") == 0) || - (strcasecmp(runit, "week") == 0) || - (strcasecmp(runit, "day") == 0) || - (strcasecmp(runit, "hour") == 0) || - (strcasecmp(runit, "minute") == 0)) { - /* all good values */ + (strcasecmp(runit, "week") == 0) || + (strcasecmp(runit, "day") == 0) || + (strcasecmp(runit, "hour") == 0) || + (strcasecmp(runit, "minute") == 0)) { + /* all good values */ } else { - PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, - "%s: unknown unit "%s"", attrname, runit ); - rv = LDAP_OPERATIONS_ERROR; + PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, + "%s: unknown unit "%s"", attrname, runit ); + rv = LDAP_OPERATIONS_ERROR; }

/* return if we aren't doing this for real */ if ( !apply ) { - return rv; + return rv; }

switch (logtype) { case SLAPD_ACCESS_LOG: - LOG_ACCESS_LOCK_WRITE( ); - origvalue = loginfo.log_access_rotationtime; - break; + LOG_ACCESS_LOCK_WRITE( ); + origvalue = loginfo.log_access_rotationtime; + break; case SLAPD_ERROR_LOG: - LOG_ERROR_LOCK_WRITE( ); - origvalue = loginfo.log_error_rotationtime; - break; + LOG_ERROR_LOCK_WRITE( ); + origvalue = loginfo.log_error_rotationtime; + break; case SLAPD_AUDIT_LOG: - LOG_AUDIT_LOCK_WRITE( ); - origvalue = loginfo.log_audit_rotationtime; - break; + LOG_AUDIT_LOCK_WRITE( ); + origvalue = loginfo.log_audit_rotationtime; + break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + origvalue = loginfo.log_auditfail_rotationtime; + break; }

if (strcasecmp(runit, "month") == 0) { - runitType = LOG_UNIT_MONTHS; - value = origvalue * 31 * 24 * 60 * 60; + runitType = LOG_UNIT_MONTHS; + value = origvalue * 31 * 24 * 60 * 60; } else if (strcasecmp(runit, "week") == 0) { - runitType = LOG_UNIT_WEEKS; - value = origvalue * 7 * 24 * 60 * 60; + runitType = LOG_UNIT_WEEKS; + value = origvalue * 7 * 24 * 60 * 60; } else if (strcasecmp(runit, "day") == 0) { - runitType = LOG_UNIT_DAYS; - value = origvalue * 24 * 60 * 60; + runitType = LOG_UNIT_DAYS; + value = origvalue * 24 * 60 * 60; } else if (strcasecmp(runit, "hour") == 0) { - runitType = LOG_UNIT_HOURS; - value = origvalue * 3600; + runitType = LOG_UNIT_HOURS; + value = origvalue * 3600; } else if (strcasecmp(runit, "minute") == 0) { - runitType = LOG_UNIT_MINS; - value = origvalue * 60; + runitType = LOG_UNIT_MINS; + value = origvalue * 60; } else { - /* In this case we don't rotate */ - runitType = LOG_UNIT_UNKNOWN; - value = -1; + /* In this case we don't rotate */ + runitType = LOG_UNIT_UNKNOWN; + value = -1; }

if (origvalue > 0 && value < 0) { - value = PR_INT32_MAX; /* overflown */ + value = PR_INT32_MAX; /* overflown */ }

switch (logtype) { case SLAPD_ACCESS_LOG: - loginfo.log_access_rotationtime_secs = value; - loginfo.log_access_rotationunit = runitType; - slapi_ch_free ( (void **) &fe_cfg->accesslog_rotationunit); - fe_cfg->accesslog_rotationunit = slapi_ch_strdup ( runit ); - LOG_ACCESS_UNLOCK_WRITE(); - break; + loginfo.log_access_rotationtime_secs = value; + loginfo.log_access_rotationunit = runitType; + slapi_ch_free ( (void **) &fe_cfg->accesslog_rotationunit); + fe_cfg->accesslog_rotationunit = slapi_ch_strdup ( runit ); + LOG_ACCESS_UNLOCK_WRITE(); + break; case SLAPD_ERROR_LOG: - loginfo.log_error_rotationtime_secs = value; - loginfo.log_error_rotationunit = runitType; - slapi_ch_free ( (void **) &fe_cfg->errorlog_rotationunit) ; - fe_cfg->errorlog_rotationunit = slapi_ch_strdup ( runit ); - LOG_ERROR_UNLOCK_WRITE(); - break; + loginfo.log_error_rotationtime_secs = value; + loginfo.log_error_rotationunit = runitType; + slapi_ch_free ( (void **) &fe_cfg->errorlog_rotationunit) ; + fe_cfg->errorlog_rotationunit = slapi_ch_strdup ( runit ); + LOG_ERROR_UNLOCK_WRITE(); + break; case SLAPD_AUDIT_LOG: - loginfo.log_audit_rotationtime_secs = value; - loginfo.log_audit_rotationunit = runitType; - slapi_ch_free ( (void **) &fe_cfg->auditlog_rotationunit); - fe_cfg->auditlog_rotationunit = slapi_ch_strdup ( runit ); - LOG_AUDIT_UNLOCK_WRITE(); - break; + loginfo.log_audit_rotationtime_secs = value; + loginfo.log_audit_rotationunit = runitType; + slapi_ch_free ( (void **) &fe_cfg->auditlog_rotationunit); + fe_cfg->auditlog_rotationunit = slapi_ch_strdup ( runit ); + LOG_AUDIT_UNLOCK_WRITE(); + break; + case SLAPD_AUDITFAIL_LOG: + loginfo.log_auditfail_rotationtime_secs = value; + loginfo.log_auditfail_rotationunit = runitType; + slapi_ch_free ( (void **) &fe_cfg->auditfaillog_rotationunit); + fe_cfg->auditfaillog_rotationunit = slapi_ch_strdup ( runit ); + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; } return rv; } @@ -1183,75 +1365,87 @@ int log_set_rotationtimeunit(const char *attrname, char *runit, int logtype, cha int log_set_maxdiskspace(const char *attrname, char *maxdiskspace_str, int logtype, char *errorbuf, int apply) { - int rv = 0; - PRInt64 mlogsize = 0; /* in bytes */ - PRInt64 maxdiskspace; /* in bytes */ - int s_maxdiskspace; /* in megabytes */ + int rv = 0; + PRInt64 mlogsize = 0; /* in bytes */ + PRInt64 maxdiskspace; /* in bytes */ + int s_maxdiskspace; /* in megabytes */

- slapdFrontendConfig_t *fe_cfg = getFrontendConfig(); - - if ( logtype != SLAPD_ACCESS_LOG && - logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { - PR_snprintf( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, - "%s: invalid log type: %d", attrname, logtype ); - return LDAP_OPERATIONS_ERROR; - } - - if (!apply || !maxdiskspace_str || !*maxdiskspace_str) - return rv; - - s_maxdiskspace = atoi(maxdiskspace_str); + slapdFrontendConfig_t *fe_cfg = getFrontendConfig(); + + if ( logtype != SLAPD_ACCESS_LOG && + logtype != SLAPD_ERROR_LOG && + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { + PR_snprintf( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, + "%s: invalid log type: %d", attrname, logtype ); + return LDAP_OPERATIONS_ERROR; + }

- /* Disk space are in MB but store in bytes */ - switch (logtype) { - case SLAPD_ACCESS_LOG: - LOG_ACCESS_LOCK_WRITE( ); - mlogsize = loginfo.log_access_maxlogsize; - break; - case SLAPD_ERROR_LOG: - LOG_ERROR_LOCK_WRITE( ); - mlogsize = loginfo.log_error_maxlogsize; - break; - case SLAPD_AUDIT_LOG: - LOG_AUDIT_LOCK_WRITE( ); - mlogsize = loginfo.log_audit_maxlogsize; - break; - } - maxdiskspace = (PRInt64)s_maxdiskspace * LOG_MB_IN_BYTES; - if (maxdiskspace < 0) { - maxdiskspace = -1; - } else if (maxdiskspace < mlogsize) { - rv = LDAP_OPERATIONS_ERROR; - PR_snprintf( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, - "%s: "%d (MB)" is less than max log size "%d (MB)"", - attrname, s_maxdiskspace, (int)(mlogsize/LOG_MB_IN_BYTES) ); - } + if (!apply || !maxdiskspace_str || !*maxdiskspace_str) + return rv; + + s_maxdiskspace = atoi(maxdiskspace_str); + + /* Disk space are in MB but store in bytes */ + switch (logtype) { + case SLAPD_ACCESS_LOG: + LOG_ACCESS_LOCK_WRITE( ); + mlogsize = loginfo.log_access_maxlogsize; + break; + case SLAPD_ERROR_LOG: + LOG_ERROR_LOCK_WRITE( ); + mlogsize = loginfo.log_error_maxlogsize; + break; + case SLAPD_AUDIT_LOG: + LOG_AUDIT_LOCK_WRITE( ); + mlogsize = loginfo.log_audit_maxlogsize; + break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + mlogsize = loginfo.log_auditfail_maxlogsize; + break; + } + maxdiskspace = (PRInt64)s_maxdiskspace * LOG_MB_IN_BYTES; + if (maxdiskspace < 0) { + maxdiskspace = -1; + } else if (maxdiskspace < mlogsize) { + rv = LDAP_OPERATIONS_ERROR; + PR_snprintf( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, + "%s: "%d (MB)" is less than max log size "%d (MB)"", + attrname, s_maxdiskspace, (int)(mlogsize/LOG_MB_IN_BYTES) ); + }

- switch (logtype) { - case SLAPD_ACCESS_LOG: - if (rv== 0 && apply) { - loginfo.log_access_maxdiskspace = maxdiskspace; /* in bytes */ - fe_cfg->accesslog_maxdiskspace = s_maxdiskspace; /* in megabytes */ - } - LOG_ACCESS_UNLOCK_WRITE(); - break; - case SLAPD_ERROR_LOG: - if (rv== 0 && apply) { - loginfo.log_error_maxdiskspace = maxdiskspace; /* in bytes */ - fe_cfg->errorlog_maxdiskspace = s_maxdiskspace; /* in megabytes */ - } - LOG_ERROR_UNLOCK_WRITE(); - break; - case SLAPD_AUDIT_LOG: - if (rv== 0 && apply) { - loginfo.log_audit_maxdiskspace = maxdiskspace; /* in bytes */ - fe_cfg->auditlog_maxdiskspace = s_maxdiskspace; /* in megabytes */ - } - LOG_AUDIT_UNLOCK_WRITE(); - break; - } - return rv; + switch (logtype) { + case SLAPD_ACCESS_LOG: + if (rv== 0 && apply) { + loginfo.log_access_maxdiskspace = maxdiskspace; /* in bytes */ + fe_cfg->accesslog_maxdiskspace = s_maxdiskspace; /* in megabytes */ + } + LOG_ACCESS_UNLOCK_WRITE(); + break; + case SLAPD_ERROR_LOG: + if (rv== 0 && apply) { + loginfo.log_error_maxdiskspace = maxdiskspace; /* in bytes */ + fe_cfg->errorlog_maxdiskspace = s_maxdiskspace; /* in megabytes */ + } + LOG_ERROR_UNLOCK_WRITE(); + break; + case SLAPD_AUDIT_LOG: + if (rv== 0 && apply) { + loginfo.log_audit_maxdiskspace = maxdiskspace; /* in bytes */ + fe_cfg->auditlog_maxdiskspace = s_maxdiskspace; /* in megabytes */ + } + LOG_AUDIT_UNLOCK_WRITE(); + break; + case SLAPD_AUDITFAIL_LOG: + if (rv== 0 && apply) { + loginfo.log_auditfail_maxdiskspace = maxdiskspace; /* in bytes */ + fe_cfg->auditfaillog_maxdiskspace = s_maxdiskspace; /* in megabytes */ + } + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; + } + return rv;

} /****************************************************************************** @@ -1271,7 +1465,8 @@ log_set_mindiskspace(const char *attrname, char *minfreespace_str, int logtype, if ( logtype != SLAPD_ACCESS_LOG && logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { PR_snprintf( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid log type: %d", attrname, logtype ); rv = LDAP_OPERATIONS_ERROR; @@ -1306,7 +1501,14 @@ log_set_mindiskspace(const char *attrname, char *minfreespace_str, int logtype, fe_cfg->auditlog_minfreespace = minfreespace; LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + loginfo.log_auditfail_minfreespace = minfreespaceB; + fe_cfg->auditfaillog_minfreespace = minfreespace; + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; default: + /* This is unreachable ... */ rv = 1; } } @@ -1329,7 +1531,8 @@ log_set_expirationtime(const char *attrname, char *exptime_str, int logtype, cha if ( logtype != SLAPD_ACCESS_LOG && logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { PR_snprintf( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid log type: %d", attrname, logtype ); rv = LDAP_OPERATIONS_ERROR; @@ -1361,7 +1564,14 @@ log_set_expirationtime(const char *attrname, char *exptime_str, int logtype, cha eunit = loginfo.log_audit_exptimeunit; rsec = loginfo.log_audit_rotationtime_secs; break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + loginfo.log_auditfail_exptime = exptime; + eunit = loginfo.log_auditfail_exptimeunit; + rsec = loginfo.log_auditfail_rotationtime_secs; + break; default: + /* This is unreachable */ rv = 1; eunit = -1; } @@ -1400,6 +1610,11 @@ log_set_expirationtime(const char *attrname, char *exptime_str, int logtype, cha fe_cfg->auditlog_exptime = exptime; LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + loginfo.log_auditfail_exptime_secs = value; + fe_cfg->auditfaillog_exptime = exptime; + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; default: rv = 1; } @@ -1423,7 +1638,8 @@ log_set_expirationtimeunit(const char *attrname, char *expunit, int logtype, cha

if ( logtype != SLAPD_ACCESS_LOG && logtype != SLAPD_ERROR_LOG && - logtype != SLAPD_AUDIT_LOG ) { + logtype != SLAPD_AUDIT_LOG && + logtype != SLAPD_AUDITFAIL_LOG ) { PR_snprintf( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "%s: invalid log type: %d", attrname, logtype ); return LDAP_OPERATIONS_ERROR; @@ -1469,6 +1685,12 @@ log_set_expirationtimeunit(const char *attrname, char *expunit, int logtype, cha rsecs = loginfo.log_audit_rotationtime_secs; exptimeunitp = &(loginfo.log_audit_exptimeunit); break; + case SLAPD_AUDITFAIL_LOG: + LOG_AUDITFAIL_LOCK_WRITE( ); + exptime = loginfo.log_auditfail_exptime; + rsecs = loginfo.log_auditfail_rotationtime_secs; + exptimeunitp = &(loginfo.log_auditfail_exptimeunit); + break; }

value = -1; @@ -1518,6 +1740,12 @@ log_set_expirationtimeunit(const char *attrname, char *expunit, int logtype, cha fe_cfg->auditlog_exptimeunit = slapi_ch_strdup ( expunit ); LOG_AUDIT_UNLOCK_WRITE(); break; + case SLAPD_AUDITFAIL_LOG: + loginfo.log_auditfail_exptime_secs = value; + slapi_ch_free ( (void **) &(fe_cfg->auditfaillog_exptimeunit) ); + fe_cfg->auditfaillog_exptimeunit = slapi_ch_strdup ( expunit ); + LOG_AUDITFAIL_UNLOCK_WRITE(); + break; }

return rv; @@ -1630,6 +1858,45 @@ audit_log_openf( char *pathname, int locked)

return rv; } + +/****************************************************************************** +* init function for the auditfail log +* Returns: +* 0 - success +* 1 - fail +******************************************************************************/ +int +auditfail_log_openf( char *pathname, int locked) +{ + + int rv=0; + int logfile_type = 0; + + if (!locked) LOG_AUDITFAIL_LOCK_WRITE( ); + + /* store the path name */ + slapi_ch_free_string(&loginfo.log_auditfail_file); + loginfo.log_auditfail_file = slapi_ch_strdup ( pathname ); + + /* store the rotation info file path name */ + slapi_ch_free_string(&loginfo.log_auditfailinfo_file); + loginfo.log_auditfailinfo_file = slapi_ch_smprintf("%s.rotationinfo", pathname); + + /* + ** Check if we have a log file already. If we have it then + ** we need to parse the header info and update the loginfo + ** struct. + */ + logfile_type = log__auditfail_rotationinfof(loginfo.log_auditfailinfo_file); + + if (log__open_auditfaillogfile(logfile_type, 1/* got lock*/) != LOG_SUCCESS) { + rv = 1; + } + + if (!locked) LOG_AUDITFAIL_UNLOCK_WRITE(); + + return rv; +} /****************************************************************************** * write in the audit log ******************************************************************************/ @@ -1664,6 +1931,39 @@ slapd_log_audit_proc ( return 0; } /****************************************************************************** +* write in the audit fail log +******************************************************************************/ +int +slapd_log_auditfail_proc ( + char *buffer, + int buf_len) +{ + if ( (loginfo.log_auditfail_state & LOGGING_ENABLED) && (loginfo.log_auditfail_file != NULL) ){ + LOG_AUDITFAIL_LOCK_WRITE( ); + if (log__needrotation(loginfo.log_auditfail_fdes, + SLAPD_AUDITFAIL_LOG) == LOG_ROTATE) { + if (log__open_auditfaillogfile(LOGFILE_NEW, 1) != LOG_SUCCESS) { + LDAPDebug(LDAP_DEBUG_ANY, + "LOGINFO: Unable to open auditfail file:%s\n", + loginfo.log_auditfail_file,0,0); + LOG_AUDITFAIL_UNLOCK_WRITE(); + return 0; + } + while (loginfo.log_auditfail_rotationsyncclock <= loginfo.log_auditfail_ctime) { + loginfo.log_auditfail_rotationsyncclock += PR_ABS(loginfo.log_auditfail_rotationtime_secs); + } + } + if (loginfo.log_auditfail_state & LOGGING_NEED_TITLE) { + log_write_title( loginfo.log_auditfail_fdes); + loginfo.log_auditfail_state &= ~LOGGING_NEED_TITLE; + } + LOG_WRITE_NOW_NO_ERR(loginfo.log_auditfail_fdes, buffer, buf_len, 0); + LOG_AUDITFAIL_UNLOCK_WRITE(); + return 0; + } + return 0; +} +/****************************************************************************** * write in the error log ******************************************************************************/ int @@ -2233,6 +2533,15 @@ log__needrotation(LOGFD fp, int logtype) rotationtime_secs = loginfo.log_audit_rotationtime_secs; log_createtime = loginfo.log_audit_ctime; break; + case SLAPD_AUDITFAIL_LOG: + nlogs = loginfo.log_auditfail_maxnumlogs; + maxlogsize = loginfo.log_auditfail_maxlogsize; + sync_enabled = loginfo.log_auditfail_rotationsync_enabled; + syncclock = loginfo.log_auditfail_rotationsyncclock; + timeunit = loginfo.log_auditfail_rotationunit; + rotationtime_secs = loginfo.log_auditfail_rotationtime_secs; + log_createtime = loginfo.log_auditfail_ctime; + break; default: /* error */ maxlogsize = -1; nlogs = 1; @@ -3398,6 +3707,173 @@ delete_logfile: }

/****************************************************************************** +* log__delete_auditfail_logfile +* +* Do we need to delete a logfile. Find out if we need to delete the log +* file based on expiration time, max diskspace, and minfreespace. +* Delete the file if we need to. +* +* Assumption: A WRITE lock has been acquired for the auditfail log +******************************************************************************/ + +static int +log__delete_auditfail_logfile() +{ + struct logfileinfo *logp = NULL; + struct logfileinfo *delete_logp = NULL; + struct logfileinfo *p_delete_logp = NULL; + struct logfileinfo *prev_logp = NULL; + PRInt64 total_size=0; + time_t cur_time; + PRInt64 f_size; + int numoflogs=loginfo.log_numof_auditfail_logs; + int rv = 0; + char *logstr; + char buffer[BUFSIZ]; + char tbuf[TBUFSIZE]; + + /* If we have only one log, then will delete this one */ + if (loginfo.log_auditfail_maxnumlogs == 1) { + LOG_CLOSE(loginfo.log_auditfail_fdes); + loginfo.log_auditfail_fdes = NULL; + PR_snprintf(buffer, sizeof(buffer), "%s", loginfo.log_auditfail_file); + if (PR_Delete(buffer) != PR_SUCCESS) { + PRErrorCode prerr = PR_GetError(); + if (PR_FILE_NOT_FOUND_ERROR == prerr) { + slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_auditfail_file); + } else { + slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n", + loginfo.log_auditfail_file, prerr, slapd_pr_strerror(prerr)); + } + } + + /* Delete the rotation file also. */ + PR_snprintf(buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_auditfail_file); + if (PR_Delete(buffer) != PR_SUCCESS) { + PRErrorCode prerr = PR_GetError(); + if (PR_FILE_NOT_FOUND_ERROR == prerr) { + slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_auditfail_file); + } else { + slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotatoininfo error %d (%s)\n", + loginfo.log_auditfail_file, prerr, slapd_pr_strerror(prerr)); + } + } + return 0; + } + + /* If we have already the maximum number of log files, we + ** have to delete one any how. + */ + if (++numoflogs > loginfo.log_auditfail_maxnumlogs) { + logstr = "Delete Error Log File: Exceeded max number of logs allowed"; + goto delete_logfile; + } + + /* Now check based on the maxdiskspace */ + if (loginfo.log_auditfail_maxdiskspace > 0) { + logp = loginfo.log_auditfail_logchain; + while (logp) { + total_size += logp->l_size; + logp = logp->l_next; + } + if ((f_size = log__getfilesize(loginfo.log_auditfail_fdes)) == -1) { + /* then just assume the max size */ + total_size += loginfo.log_auditfail_maxlogsize; + } else { + total_size += f_size; + } + + /* If we have exceeded the max disk space or we have less than the + ** minimum, then we have to delete a file. + */ + if (total_size >= loginfo.log_auditfail_maxdiskspace) { + logstr = "exceeded maximum log disk space"; + goto delete_logfile; + } + } + + /* Now check based on the free space */ + if ( loginfo.log_auditfail_minfreespace > 0) { + rv = log__enough_freespace(loginfo.log_auditfail_file); + if ( rv == 0) { + /* Not enough free space */ + logstr = "Not enough free disk space"; + goto delete_logfile; + } + } + + /* Now check based on the expiration time */ + if ( loginfo.log_auditfail_exptime_secs > 0 ) { + /* is the file old enough */ + time (&cur_time); + prev_logp = logp = loginfo.log_auditfail_logchain; + while (logp) { + if ((cur_time - logp->l_ctime) > loginfo.log_auditfail_exptime_secs) { + delete_logp = logp; + p_delete_logp = prev_logp; + logstr = "The file is older than the log expiration time"; + goto delete_logfile; + } + prev_logp = logp; + logp = logp->l_next; + } + } + + /* No log files to delete */ + return 0; + +delete_logfile: + if (delete_logp == NULL) { + time_t oldest; + + time(&oldest); + + prev_logp = logp = loginfo.log_auditfail_logchain; + while (logp) { + if (logp->l_ctime <= oldest) { + oldest = logp->l_ctime; + delete_logp = logp; + p_delete_logp = prev_logp; + } + prev_logp = logp; + logp = logp->l_next; + } + /* We might face this case if we have only one log file and + ** trying to delete it because of deletion requirement. + */ + if (!delete_logp) { + return 0; + } + } + + if (p_delete_logp == delete_logp) { + /* then we are deleteing the first one */ + loginfo.log_auditfail_logchain = delete_logp->l_next; + } else { + p_delete_logp->l_next = delete_logp->l_next; + } + + /* Delete the audit file */ + log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */); + PR_snprintf(buffer, sizeof(buffer), "%s.%s", loginfo.log_auditfail_file, tbuf ); + if (PR_Delete(buffer) != PR_SUCCESS) { + PRErrorCode prerr = PR_GetError(); + if (PR_FILE_NOT_FOUND_ERROR == prerr) { + slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_auditfail_file); + } else { + slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n", + loginfo.log_auditfail_file, tbuf, prerr, slapd_pr_strerror(prerr)); + } + } else { + slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_auditfail_file, tbuf, logstr); + } + slapi_ch_free((void**)&delete_logp); + loginfo.log_numof_auditfail_logs--; + + return 1; +} + +/****************************************************************************** * log__error_rotationinfof * * Try to open the log file. If we have one already, then try to read the @@ -3571,6 +4047,101 @@ log__audit_rotationinfof( char *pathname) return logfile_type; }

+/****************************************************************************** +* log__auditfail_rotationinfof +* +* Try to open the log file. If we have one already, then try to read the +* header and update the information. +* +* Assumption: Lock has been acquired already +******************************************************************************/ +static int +log__auditfail_rotationinfof( char *pathname) +{ + long f_ctime; + PRInt64 f_size; + int main_log = 1; + time_t now; + FILE *fp; + int rval, logfile_type = LOGFILE_REOPENED; + + /* + ** Okay -- I confess, we want to use NSPR calls but I want to + ** use fgets and not use PR_Read() and implement a complicated + ** parsing module. Since this will be called only during the startup + ** and never aftre that, we can live by it. + */ + + if ((fp = fopen (pathname, "r")) == NULL) { + return LOGFILE_NEW; + } + + loginfo.log_numof_auditfail_logs = 0; + + /* + ** We have reopened the log audit file. Now we need to read the + ** log file info and update the values. + */ + while ((rval = log__extract_logheader(fp, &f_ctime, &f_size)) == LOG_CONTINUE) { + /* first we would get the main log info */ + if (f_ctime == 0 && f_size == 0) { + continue; + } + time (&now); + if (main_log) { + if (f_ctime > 0L) { + loginfo.log_auditfail_ctime = f_ctime; + } + else { + loginfo.log_auditfail_ctime = now; + } + main_log = 0; + } else { + struct logfileinfo *logp; + + logp = (struct logfileinfo *) slapi_ch_malloc (sizeof (struct logfileinfo)); + if (f_ctime > 0L) { + logp->l_ctime = f_ctime; + } + else { + logp->l_ctime = now; + } + if (f_size > 0) { + logp->l_size = f_size; + } + else { + /* make it the max log size */ + logp->l_size = loginfo.log_auditfail_maxlogsize; + } + + logp->l_next = loginfo.log_auditfail_logchain; + loginfo.log_auditfail_logchain = logp; + } + loginfo.log_numof_auditfail_logs++; + } + if (LOG_DONE == rval) { + rval = log__check_prevlogs(fp, pathname); + } + fclose (fp); + + if (LOG_ERROR == rval) { + if (LOG_SUCCESS == log__fix_rotationinfof(pathname)) { + logfile_type = LOGFILE_NEW; + } + } + + /* Check if there is a rotation overdue */ + if (loginfo.log_auditfail_rotationsync_enabled && + loginfo.log_auditfail_rotationunit != LOG_UNIT_HOURS && + loginfo.log_auditfail_rotationunit != LOG_UNIT_MINS && + loginfo.log_auditfail_ctime < loginfo.log_auditfail_rotationsyncclock - PR_ABS(loginfo.log_auditfail_rotationtime_secs)) + { + loginfo.log_auditfail_rotationsyncclock -= PR_ABS(loginfo.log_auditfail_rotationtime_secs); + } + + return logfile_type; +} + static void log__error_emergency(const char *errstr, int reopen, int locked) { @@ -3889,6 +4460,132 @@ log__open_auditlogfile(int logfile_state, int locked) if (!locked) LOG_AUDIT_UNLOCK_WRITE( ); return LOG_SUCCESS; } +/****************************************************************************** +* log__open_auditfaillogfile +* +* Open a new log file. If we have run out of the max logs we can have +* then delete the oldest file. +******************************************************************************/ +static int +log__open_auditfaillogfile(int logfile_state, int locked) +{ + + time_t now; + LOGFD fp; + LOGFD fpinfo = NULL; + char tbuf[TBUFSIZE]; + struct logfileinfo *logp; + char buffer[BUFSIZ]; + + if (!locked) LOG_AUDITFAIL_LOCK_WRITE( ); + + /* + ** Here we are trying to create a new log file. + ** If we alredy have one, then we need to rename it as + ** "filename.time", close it and update it's information + ** in the array stack. + */ + if (loginfo.log_auditfail_fdes != NULL) { + struct logfileinfo *log; + char newfile[BUFSIZ]; + PRInt64 f_size; + + + /* get rid of the old one */ + if ((f_size = log__getfilesize(loginfo.log_auditfail_fdes)) == -1) { + /* Then assume that we have the max size */ + f_size = loginfo.log_auditfail_maxlogsize; + } + + /* Check if I have to delete any old file, delete it if it is required. */ + while (log__delete_auditfail_logfile()); + + /* close the file */ + LOG_CLOSE(loginfo.log_auditfail_fdes); + loginfo.log_auditfail_fdes = NULL; + + if ( loginfo.log_auditfail_maxnumlogs > 1 ) { + log = (struct logfileinfo *) slapi_ch_malloc (sizeof (struct logfileinfo)); + log->l_ctime = loginfo.log_auditfail_ctime; + log->l_size = f_size; + + log_convert_time (log->l_ctime, tbuf, 1 /*short */); + PR_snprintf(newfile, sizeof(newfile), "%s.%s", loginfo.log_auditfail_file, tbuf); + if (PR_Rename (loginfo.log_auditfail_file, newfile) != PR_SUCCESS) { + PRErrorCode prerr = PR_GetError(); + /* Make "FILE EXISTS" error an exception. + Even if PR_Rename fails with the error, we continue logging. + */ + if (PR_FILE_EXISTS_ERROR != prerr) { + if (!locked) LOG_AUDITFAIL_UNLOCK_WRITE(); + slapi_ch_free((void**)&log); + return LOG_UNABLE_TO_OPENFILE; + } + } + + /* add the log to the chain */ + log->l_next = loginfo.log_auditfail_logchain; + loginfo.log_auditfail_logchain = log; + loginfo.log_numof_auditfail_logs++; + } + } + + /* open a new log file */ + if (! LOG_OPEN_APPEND(fp, loginfo.log_auditfail_file, loginfo.log_auditfail_mode)) { + LDAPDebug(LDAP_DEBUG_ANY, "WARNING: can't open file %s. " + "errno %d (%s)\n", + loginfo.log_auditfail_file, errno, slapd_system_strerror(errno)); + if (!locked) LOG_AUDITFAIL_UNLOCK_WRITE(); + /*if I have an old log file -- I should log a message + ** that I can't open the new file. Let the caller worry + ** about logging message. + */ + return LOG_UNABLE_TO_OPENFILE; + } + + loginfo.log_auditfail_fdes = fp; + if (logfile_state == LOGFILE_REOPENED) { + /* we have all the information */ + if (!locked) LOG_AUDITFAIL_UNLOCK_WRITE(); + return LOG_SUCCESS; + } + + loginfo.log_auditfail_state |= LOGGING_NEED_TITLE; + + if (! LOG_OPEN_WRITE(fpinfo, loginfo.log_auditfailinfo_file, loginfo.log_auditfail_mode)) { + LDAPDebug(LDAP_DEBUG_ANY, "WARNING: can't open file %s. " + "errno %d (%s)\n", + loginfo.log_auditfailinfo_file, errno, slapd_system_strerror(errno)); + if (!locked) LOG_AUDITFAIL_UNLOCK_WRITE(); + return LOG_UNABLE_TO_OPENFILE; + } + + /* write the header in the log */ + now = current_time(); + log_convert_time (now, tbuf, 2 /*long */); + PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Log file created at: %s (%lu)\n", tbuf, now); + LOG_WRITE(fpinfo, buffer, strlen(buffer), 0); + + logp = loginfo.log_auditfail_logchain; + while ( logp) { + log_convert_time (logp->l_ctime, tbuf, 1 /*short */); + PR_snprintf(buffer, sizeof(buffer), "LOGINFO:%s%s.%s (%lu) (%" + NSPRI64 "d)\n", PREVLOGFILE, loginfo.log_auditfail_file, tbuf, + logp->l_ctime, logp->l_size); + LOG_WRITE(fpinfo, buffer, strlen(buffer), 0); + logp = logp->l_next; + } + /* Close the info file. We need only when we need to rotate to the + ** next log file. + */ + if (fpinfo) LOG_CLOSE(fpinfo); + + /* This is now the current audit log */ + loginfo.log_auditfail_ctime = now; + + if (!locked) LOG_AUDITFAIL_UNLOCK_WRITE( ); + return LOG_SUCCESS; +}

/* ** Log Buffering diff --git a/ldap/servers/slapd/log.h b/ldap/servers/slapd/log.h index 40df6d7..6c5f4f1 100644 --- a/ldap/servers/slapd/log.h +++ b/ldap/servers/slapd/log.h @@ -176,6 +176,32 @@ struct logging_opts { char *log_auditinfo_file; /* audit log rotation info file */ Slapi_RWLock *log_audit_rwlock; /* lock on audit*/

+ /* These are auditfail log specific */ + int log_auditfail_state; + int log_auditfail_mode; /* access mode */ + int log_auditfail_maxnumlogs; /* Number of logs */ + PRInt64 log_auditfail_maxlogsize; /* max log size in bytes*/ + int log_auditfail_rotationtime; /* time in units. */ + int log_auditfail_rotationunit; /* time in units. */ + int log_auditfail_rotationtime_secs; /* time in seconds */ + int log_auditfail_rotationsync_enabled;/* 0 or 1*/ + int log_auditfail_rotationsynchour; /* 0-23 */ + int log_auditfail_rotationsyncmin; /* 0-59 */ + time_t log_auditfail_rotationsyncclock; /* clock in seconds */ + PRInt64 log_auditfail_maxdiskspace; /* space in bytes */ + PRInt64 log_auditfail_minfreespace; /* free space in bytes */ + int log_auditfail_exptime; /* time */ + int log_auditfail_exptimeunit; /* unit time */ + int log_auditfail_exptime_secs; /* time in secs */ + + char *log_auditfail_file; /* auditfail log name */ + LOGFD log_auditfail_fdes; /* auditfail log fdes */ + unsigned int log_numof_auditfail_logs; /* number of logs */ + time_t log_auditfail_ctime; /* log creation time */ + LogFileInfo *log_auditfail_logchain; /* all the logs info */ + char *log_auditfailinfo_file; /* auditfail log rotation info file */ + Slapi_RWLock *log_auditfail_rwlock; /* lock on auditfail */ + };

/* For log_state */ @@ -197,3 +223,8 @@ struct logging_opts { #define LOG_AUDIT_LOCK_WRITE() slapi_rwlock_wrlock(loginfo.log_audit_rwlock) #define LOG_AUDIT_UNLOCK_WRITE() slapi_rwlock_unlock(loginfo.log_audit_rwlock)

+#define LOG_AUDITFAIL_LOCK_READ() slapi_rwlock_rdlock(loginfo.log_auditfail_rwlock) +#define LOG_AUDITFAIL_UNLOCK_READ() slapi_rwlock_unlock(loginfo.log_auditfail_rwlock) +#define LOG_AUDITFAIL_LOCK_WRITE() slapi_rwlock_wrlock(loginfo.log_auditfail_rwlock) +#define LOG_AUDITFAIL_UNLOCK_WRITE() slapi_rwlock_unlock(loginfo.log_auditfail_rwlock) + diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c index 9225d31..4c0becc 100644 --- a/ldap/servers/slapd/modify.c +++ b/ldap/servers/slapd/modify.c @@ -1079,6 +1079,11 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw) operation_out_of_disk_space(); goto free_and_return; } + /* If the disk is full we don't want to make it worse ... */ + if (operation_is_flag_set(operation,OP_FLAG_ACTION_LOG_AUDIT)) + { + write_auditfail_log_entry(pb); /* Record the operation in the audit log */ + } } } else diff --git a/ldap/servers/slapd/modrdn.c b/ldap/servers/slapd/modrdn.c index e80e1f9..d0ef1b1 100644 --- a/ldap/servers/slapd/modrdn.c +++ b/ldap/servers/slapd/modrdn.c @@ -641,6 +641,12 @@ op_shared_rename(Slapi_PBlock *pb, int passin_args) slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &ecopy); /* GGOODREPL persistent search system needs the changenumber, oops. */ do_ps_service(pse, ecopy, LDAP_CHANGETYPE_MODDN, 0); + } else { + /* Should we also be doing a disk space check here? */ + if (operation_is_flag_set(operation,OP_FLAG_ACTION_LOG_AUDIT)) + { + write_auditfail_log_entry(pb); /* Record the operation in the audit log */ + } } } else diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index ff9dd09..22e8007 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -293,6 +293,7 @@ int config_set_timelimit(const char *attrname, char *value, char *errorbuf, int int config_set_errorlog_level(const char *attrname, char *value, char *errorbuf, int apply ); int config_set_accesslog_level(const char *attrname, char *value, char *errorbuf, int apply ); int config_set_auditlog(const char *attrname, char *value, char *errorbuf, int apply ); +int config_set_auditfaillog(const char *attrname, char *value, char *errorbuf, int apply ); int config_set_userat(const char *attrname, char *value, char *errorbuf, int apply ); int config_set_accesslog(const char *attrname, char *value, char *errorbuf, int apply ); int config_set_errorlog(const char *attrname, char *value, char *errorbuf, int apply ); @@ -372,6 +373,7 @@ int config_set_disk_threshold( const char *attrname, char *value, char *errorbuf int config_set_disk_grace_period( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_disk_logging_critical( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply); +int config_set_auditfaillog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply); int config_set_ndn_cache_enabled(const char *attrname, char *value, char *errorbuf, int apply); int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int apply); int config_set_unhashed_pw_switch(const char *attrname, char *value, char *errorbuf, int apply); @@ -476,12 +478,14 @@ char* config_get_useroc(); char *config_get_accesslog(); char *config_get_errorlog(); char *config_get_auditlog(); +char *config_get_auditfaillog(); long config_get_pw_maxage(); long config_get_pw_minage(); long config_get_pw_warning(); int config_get_errorlog_level(); int config_get_accesslog_level(); int config_get_auditlog_logging_enabled(); +int config_get_auditfaillog_logging_enabled(); char *config_get_referral_mode(void); int config_get_conntablesize(void); int config_check_referral_mode(void); @@ -503,6 +507,7 @@ char *config_get_saslpath(); char **config_get_errorlog_list(); char **config_get_accesslog_list(); char **config_get_auditlog_list(); +char **config_get_auditfaillog_list(); int config_get_attrname_exceptions(); int config_get_hash_filters(); int config_get_rewrite_rfc1274(); @@ -529,6 +534,7 @@ char *config_get_default_naming_context(void); int config_allowed_to_delete_attrs(const char *attr_type); void config_set_accesslog_enabled(int value); void config_set_auditlog_enabled(int value); +void config_set_auditfaillog_enabled(int value); int config_get_accesslog_logging_enabled(); int config_get_disk_monitoring(); PRInt64 config_get_disk_threshold(); @@ -743,18 +749,21 @@ int slapi_log_access( int level, char *fmt, ... ) ; #endif int slapd_log_audit_proc(char *buffer, int buf_len); +int slapd_log_auditfail_proc(char *buffer, int buf_len); void log_access_flush();

int access_log_openf( char *pathname, int locked); int error_log_openf( char *pathname, int locked); int audit_log_openf( char *pathname, int locked); +int auditfail_log_openf( char *pathname, int locked);

void g_set_detached(int); void g_log_init(int log_enabled); char *g_get_access_log(); char *g_get_error_log(); char *g_get_audit_log(); +char *g_get_auditfail_log(); void g_set_accesslog_level(int val);

int log_set_mode(const char *attrname, char *mode_str, int logtype, char *errorbuf, int apply); @@ -773,6 +782,7 @@ char **log_get_loglist(int logtype); int log_update_accesslogdir(char *pathname, int apply); int log_update_errorlogdir(char *pathname, int apply); int log_update_auditlogdir(char *pathname, int apply); +int log_update_auditfaillogdir(char *pathname, int apply); int log_set_logging (const char *attrname, char *value, int logtype, char *errorbuf, int apply); int check_log_max_size( char *maxdiskspace_str, @@ -1245,6 +1255,10 @@ void write_audit_log_entry( Slapi_PBlock *pb); void auditlog_hide_unhashed_pw(); void auditlog_expose_unhashed_pw();

+void write_auditfail_log_entry( Slapi_PBlock *pb); +void auditfaillog_hide_unhashed_pw(); +void auditfaillog_expose_unhashed_pw(); + /* * eventq.c */ diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index f78bc46..3cc99cf 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1883,6 +1883,7 @@ typedef struct _slapdEntryPoints { #define SLAPD_ACCESS_LOG 0x1 #define SLAPD_ERROR_LOG 0x2 #define SLAPD_AUDIT_LOG 0x4 +#define SLAPD_AUDITFAIL_LOG 0x8

#define CONFIG_DATABASE_ATTRIBUTE "nsslapd-database" #define CONFIG_PLUGIN_ATTRIBUTE "nsslapd-plugin" @@ -1907,48 +1908,63 @@ typedef struct _slapdEntryPoints { #define CONFIG_ACCESSLOG_MODE_ATTRIBUTE "nsslapd-accesslog-mode" #define CONFIG_ERRORLOG_MODE_ATTRIBUTE "nsslapd-errorlog-mode" #define CONFIG_AUDITLOG_MODE_ATTRIBUTE "nsslapd-auditlog-mode" +#define CONFIG_AUDITFAILLOG_MODE_ATTRIBUTE "nsslapd-auditfaillog-mode" #define CONFIG_ACCESSLOG_MAXNUMOFLOGSPERDIR_ATTRIBUTE "nsslapd-accesslog-maxlogsperdir" #define CONFIG_ERRORLOG_MAXNUMOFLOGSPERDIR_ATTRIBUTE "nsslapd-errorlog-maxlogsperdir" #define CONFIG_AUDITLOG_MAXNUMOFLOGSPERDIR_ATTRIBUTE "nsslapd-auditlog-maxlogsperdir" +#define CONFIG_AUDITFAILLOG_MAXNUMOFLOGSPERDIR_ATTRIBUTE "nsslapd-auditfaillog-maxlogsperdir" #define CONFIG_ACCESSLOG_MAXLOGSIZE_ATTRIBUTE "nsslapd-accesslog-maxlogsize" #define CONFIG_ERRORLOG_MAXLOGSIZE_ATTRIBUTE "nsslapd-errorlog-maxlogsize" #define CONFIG_AUDITLOG_MAXLOGSIZE_ATTRIBUTE "nsslapd-auditlog-maxlogsize" +#define CONFIG_AUDITFAILLOG_MAXLOGSIZE_ATTRIBUTE "nsslapd-auditfaillog-maxlogsize" #define CONFIG_ACCESSLOG_LOGROTATIONSYNCENABLED_ATTRIBUTE "nsslapd-accesslog-logrotationsync-enabled" #define CONFIG_ERRORLOG_LOGROTATIONSYNCENABLED_ATTRIBUTE "nsslapd-errorlog-logrotationsync-enabled" #define CONFIG_AUDITLOG_LOGROTATIONSYNCENABLED_ATTRIBUTE "nsslapd-auditlog-logrotationsync-enabled" +#define CONFIG_AUDITFAILLOG_LOGROTATIONSYNCENABLED_ATTRIBUTE "nsslapd-auditfaillog-logrotationsync-enabled" #define CONFIG_ACCESSLOG_LOGROTATIONSYNCHOUR_ATTRIBUTE "nsslapd-accesslog-logrotationsynchour" #define CONFIG_ERRORLOG_LOGROTATIONSYNCHOUR_ATTRIBUTE "nsslapd-errorlog-logrotationsynchour" #define CONFIG_AUDITLOG_LOGROTATIONSYNCHOUR_ATTRIBUTE "nsslapd-auditlog-logrotationsynchour" +#define CONFIG_AUDITFAILLOG_LOGROTATIONSYNCHOUR_ATTRIBUTE "nsslapd-auditfaillog-logrotationsynchour" #define CONFIG_ACCESSLOG_LOGROTATIONSYNCMIN_ATTRIBUTE "nsslapd-accesslog-logrotationsyncmin" #define CONFIG_ERRORLOG_LOGROTATIONSYNCMIN_ATTRIBUTE "nsslapd-errorlog-logrotationsyncmin" #define CONFIG_AUDITLOG_LOGROTATIONSYNCMIN_ATTRIBUTE "nsslapd-auditlog-logrotationsyncmin" +#define CONFIG_AUDITFAILLOG_LOGROTATIONSYNCMIN_ATTRIBUTE "nsslapd-auditfaillog-logrotationsyncmin" #define CONFIG_ACCESSLOG_LOGROTATIONTIME_ATTRIBUTE "nsslapd-accesslog-logrotationtime" #define CONFIG_ERRORLOG_LOGROTATIONTIME_ATTRIBUTE "nsslapd-errorlog-logrotationtime" #define CONFIG_AUDITLOG_LOGROTATIONTIME_ATTRIBUTE "nsslapd-auditlog-logrotationtime" +#define CONFIG_AUDITFAILLOG_LOGROTATIONTIME_ATTRIBUTE "nsslapd-auditfaillog-logrotationtime" #define CONFIG_ACCESSLOG_LOGROTATIONTIMEUNIT_ATTRIBUTE "nsslapd-accesslog-logrotationtimeunit" #define CONFIG_ERRORLOG_LOGROTATIONTIMEUNIT_ATTRIBUTE "nsslapd-errorlog-logrotationtimeunit" #define CONFIG_AUDITLOG_LOGROTATIONTIMEUNIT_ATTRIBUTE "nsslapd-auditlog-logrotationtimeunit" +#define CONFIG_AUDITFAILLOG_LOGROTATIONTIMEUNIT_ATTRIBUTE "nsslapd-auditfaillog-logrotationtimeunit" #define CONFIG_ACCESSLOG_MAXLOGDISKSPACE_ATTRIBUTE "nsslapd-accesslog-logmaxdiskspace" #define CONFIG_ERRORLOG_MAXLOGDISKSPACE_ATTRIBUTE "nsslapd-errorlog-logmaxdiskspace" #define CONFIG_AUDITLOG_MAXLOGDISKSPACE_ATTRIBUTE "nsslapd-auditlog-logmaxdiskspace" +#define CONFIG_AUDITFAILLOG_MAXLOGDISKSPACE_ATTRIBUTE "nsslapd-auditfaillog-logmaxdiskspace" #define CONFIG_ACCESSLOG_MINFREEDISKSPACE_ATTRIBUTE "nsslapd-accesslog-logminfreediskspace" #define CONFIG_ERRORLOG_MINFREEDISKSPACE_ATTRIBUTE "nsslapd-errorlog-logminfreediskspace" #define CONFIG_AUDITLOG_MINFREEDISKSPACE_ATTRIBUTE "nsslapd-auditlog-logminfreediskspace" +#define CONFIG_AUDITFAILLOG_MINFREEDISKSPACE_ATTRIBUTE "nsslapd-auditfaillog-logminfreediskspace" #define CONFIG_ACCESSLOG_LOGEXPIRATIONTIME_ATTRIBUTE "nsslapd-accesslog-logexpirationtime" #define CONFIG_ERRORLOG_LOGEXPIRATIONTIME_ATTRIBUTE "nsslapd-errorlog-logexpirationtime" #define CONFIG_AUDITLOG_LOGEXPIRATIONTIME_ATTRIBUTE "nsslapd-auditlog-logexpirationtime" +#define CONFIG_AUDITFAILLOG_LOGEXPIRATIONTIME_ATTRIBUTE "nsslapd-auditfaillog-logexpirationtime" #define CONFIG_ACCESSLOG_LOGEXPIRATIONTIMEUNIT_ATTRIBUTE "nsslapd-accesslog-logexpirationtimeunit" #define CONFIG_ERRORLOG_LOGEXPIRATIONTIMEUNIT_ATTRIBUTE "nsslapd-errorlog-logexpirationtimeunit" #define CONFIG_AUDITLOG_LOGEXPIRATIONTIMEUNIT_ATTRIBUTE "nsslapd-auditlog-logexpirationtimeunit" +#define CONFIG_AUDITFAILLOG_LOGEXPIRATIONTIMEUNIT_ATTRIBUTE "nsslapd-auditfaillog-logexpirationtimeunit" #define CONFIG_ACCESSLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-accesslog-logging-enabled" #define CONFIG_ERRORLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-errorlog-logging-enabled" #define CONFIG_AUDITLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-auditlog-logging-enabled" +#define CONFIG_AUDITFAILLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-auditfaillog-logging-enabled" #define CONFIG_AUDITLOG_LOGGING_HIDE_UNHASHED_PW "nsslapd-auditlog-logging-hide-unhashed-pw" +#define CONFIG_AUDITFAILLOG_LOGGING_HIDE_UNHASHED_PW "nsslapd-auditfaillog-logging-hide-unhashed-pw" #define CONFIG_UNHASHED_PW_SWITCH_ATTRIBUTE "nsslapd-unhashed-pw-switch" #define CONFIG_ROOTDN_ATTRIBUTE "nsslapd-rootdn" #define CONFIG_ROOTPW_ATTRIBUTE "nsslapd-rootpw" #define CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE "nsslapd-rootpwstoragescheme" #define CONFIG_AUDITFILE_ATTRIBUTE "nsslapd-auditlog" +#define CONFIG_AUDITFAILFILE_ATTRIBUTE "nsslapd-auditfaillog" #define CONFIG_LASTMOD_ATTRIBUTE "nsslapd-lastmod" #define CONFIG_INCLUDE_ATTRIBUTE "nsslapd-include" #define CONFIG_DYNAMICCONF_ATTRIBUTE "nsslapd-dynamicconf" @@ -2042,6 +2058,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_ACCESSLOG_LIST_ATTRIBUTE "nsslapd-accesslog-list" #define CONFIG_ERRORLOG_LIST_ATTRIBUTE "nsslapd-errorlog-list" #define CONFIG_AUDITLOG_LIST_ATTRIBUTE "nsslapd-auditlog-list" +#define CONFIG_AUDITFAILLOG_LIST_ATTRIBUTE "nsslapd-auditfaillog-list" #define CONFIG_REWRITE_RFC1274_ATTRIBUTE "nsslapd-rewrite-rfc1274" #define CONFIG_PLUGIN_BINDDN_TRACKING_ATTRIBUTE "nsslapd-plugin-binddn-tracking" #define CONFIG_MODDN_ACI_ATTRIBUTE "nsslapd-moddn-aci" @@ -2265,6 +2282,24 @@ typedef struct _slapdFrontendConfig { char *auditlog_exptimeunit; slapi_onoff_t auditlog_logging_hide_unhashed_pw;

+ /* AUDIT FAIL LOG */ + char *auditfaillog; + int auditfailloglevel; + slapi_onoff_t auditfaillog_logging_enabled; + char *auditfaillog_mode; + int auditfaillog_maxnumlogs; + int auditfaillog_maxlogsize; + slapi_onoff_t auditfaillog_rotationsync_enabled; + int auditfaillog_rotationsynchour; + int auditfaillog_rotationsyncmin; + int auditfaillog_rotationtime; + char *auditfaillog_rotationunit; + int auditfaillog_maxdiskspace; + int auditfaillog_minfreespace; + int auditfaillog_exptime; + char *auditfaillog_exptimeunit; + slapi_onoff_t auditfaillog_logging_hide_unhashed_pw; + slapi_onoff_t return_exact_case; /* Return attribute names with the same case as they appear in at.conf */