Skip to content

Commit b222b46

Browse files
trondntrondn
committed
MB-41183: Change representation of connection in audit
The connection details in the audit record should not be a string named sockname or peername, but use objects named remote and local "remote": { "ip": "::1", "port": 1234 }, "local": { "ip": "::1", "port": 321 } As that ease the filtering when you don't have to deal with trying to determine if it is an IPv4 or IPv6 address and how the ports are specified (IPv4: 127.0.0.1:1234, IPv6: ::1[1234]) Change-Id: I56dab58b797a12d2aac6bc03959b33d29d19527f Reviewed-on: http://review.couchbase.org/c/kv_engine/+/135419 Tested-by: Build Bot <[email protected]> Well-Formed: Build Bot <[email protected]> Reviewed-by: Daniel Owen <[email protected]>
1 parent d0ca520 commit b222b46

File tree

5 files changed

+80
-49
lines changed

5 files changed

+80
-49
lines changed

‎auditd/README.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -184,10 +184,9 @@ providing the following default values:
184184
* array: []
185185
* object: {}
186186

187-
The example JSON structure below shows the definition for the 2
188-
pre-defined mandatory fields; *timestamp* and *real_userid*, and the 3
189-
pre-defined optional fields; *sessionID*, *remote* and
190-
*effective_userid*.
187+
The example JSON structure below shows the definition for the 4
188+
pre-defined mandatory fields; *timestamp*, *real_userid*, *remote*, *local*,
189+
and the 2 pre-defined optional fields; *sessionID* and *effective_userid*.
191190

192191
{"version" : 1,
193192
"module" : "example",
@@ -199,11 +198,12 @@ pre-defined optional fields; *sessionID*, *remote* and
199198
"enabled" : true,
200199
"mandatory_fields" : {
201200
"timestamp" : "",
202-
"real_userid" : {"domain" : "", "user" : ""}
201+
"real_userid" : {"domain" : "", "user" : ""},
202+
"remote" : {"ip" : "", "port" : 1},
203+
"local": {"ip" : "", "port" : 1}
203204
},
204205
"optional_fields" : {
205-
"sessionid" : ""
206-
"remote" : {"ip" : "", "port" : 1}
206+
"sessionid" : "",
207207
"effective_userid" : {"domain" : "", "user" : ""}
208208
}
209209
}

‎daemon/connection.cc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1362,8 +1362,8 @@ Connection::Connection(FrontEndThread& thr)
13621362
connectedToSystemPort(false),
13631363
base(nullptr),
13641364
thread(thr),
1365-
peername("unknown"),
1366-
sockname("unknown"),
1365+
peername(R"({"ip":"unknown","port":0})"),
1366+
sockname(R"({"ip":"unknown","port":0})"),
13671367
stateMachine(*this),
13681368
max_reqs_per_event(Settings::instance().getRequestsPerEventNotification(
13691369
EventPriority::Default)) {
@@ -1383,8 +1383,8 @@ Connection::Connection(SOCKET sfd,
13831383
base(b),
13841384
thread(thr),
13851385
parent_port(ifc.port),
1386-
peername(cb::net::getpeername(socketDescriptor)),
1387-
sockname(cb::net::getsockname(socketDescriptor)),
1386+
peername(cb::net::getPeerNameAsJson(socketDescriptor).dump()),
1387+
sockname(cb::net::getSockNameAsJson(socketDescriptor).dump()),
13881388
stateMachine(*this),
13891389
max_reqs_per_event(Settings::instance().getRequestsPerEventNotification(
13901390
EventPriority::Default)) {

‎daemon/mcaudit.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,8 @@ static nlohmann::json create_memcached_audit_object(const Connection& c) {
9595
nlohmann::json root;
9696

9797
root["timestamp"] = ISOTime::generatetimestamp();
98-
root["peername"] = c.getPeername();
99-
root["sockname"] = c.getSockname();
98+
root["remote"] = nlohmann::json::parse(c.getPeername());
99+
root["local"] = nlohmann::json::parse(c.getSockname());
100100
root["real_userid"]["domain"] = to_string(c.getDomain());
101101
root["real_userid"]["user"] = c.getUsername();
102102

‎etc/memcached_descriptor.json‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
"domain": "",
1616
"user": ""
1717
},
18-
"bucket": ""
18+
"bucket": "",
19+
"remote": { "ip": "", "port": 1 },
20+
"local": { "ip": "", "port": 1 }
1921
},
2022
"optional_fields": {
21-
"peername": "",
22-
"sockname": ""
2323
}
2424
},
2525
{
@@ -35,11 +35,11 @@
3535
"domain": "",
3636
"user": ""
3737
},
38-
"reason": ""
38+
"reason": "",
39+
"remote": { "ip": "", "port": 1 },
40+
"local": { "ip": "", "port": 1 }
3941
},
4042
"optional_fields": {
41-
"peername": "",
42-
"sockname": ""
4343
}
4444
},
4545
{
@@ -55,11 +55,11 @@
5555
"domain": "",
5656
"user": ""
5757
},
58-
"bucket": ""
58+
"bucket": "",
59+
"remote": { "ip": "", "port": 1 },
60+
"local": { "ip": "", "port": 1 }
5961
},
6062
"optional_fields": {
61-
"peername": "",
62-
"sockname": ""
6363
}
6464
},
6565
{
@@ -75,11 +75,11 @@
7575
"domain": "",
7676
"user": ""
7777
},
78-
"bucket": ""
78+
"bucket": "",
79+
"remote": { "ip": "", "port": 1 },
80+
"local": { "ip": "", "port": 1 }
7981
},
8082
"optional_fields": {
81-
"peername": "",
82-
"sockname": ""
8383
}
8484
},
8585
{
@@ -95,11 +95,11 @@
9595
"domain": "",
9696
"user": ""
9797
},
98-
"bucket": ""
98+
"bucket": "",
99+
"remote": { "ip": "", "port": 1 },
100+
"local": { "ip": "", "port": 1 }
99101
},
100102
"optional_fields": {
101-
"peername": "",
102-
"sockname": ""
103103
}
104104
},
105105
{
@@ -114,11 +114,11 @@
114114
"real_userid": {
115115
"domain": "",
116116
"user": ""
117-
}
117+
},
118+
"remote": { "ip": "", "port": 1 },
119+
"local": { "ip": "", "port": 1 }
118120
},
119121
"optional_fields": {
120-
"peername": "",
121-
"sockname": ""
122122
}
123123
},
124124
{
@@ -135,8 +135,8 @@
135135
"domain": "",
136136
"user": ""
137137
},
138-
"peername": "",
139-
"sockname": ""
138+
"remote": { "ip": "", "port": 1 },
139+
"local": { "ip": "", "port": 1 }
140140
},
141141
"optional_fields": {
142142
}
@@ -158,8 +158,8 @@
158158
"domain": "",
159159
"user": ""
160160
},
161-
"peername": "",
162-
"sockname": ""
161+
"remote": { "ip": "", "port": 1 },
162+
"local": { "ip": "", "port": 1 }
163163
},
164164
"optional_fields": {
165165
}
@@ -179,8 +179,8 @@
179179
"domain": "",
180180
"user": ""
181181
},
182-
"peername": "",
183-
"sockname": ""
182+
"remote": { "ip": "", "port": 1 },
183+
"local": { "ip": "", "port": 1 }
184184
},
185185
"optional_fields": {
186186
}
@@ -200,8 +200,8 @@
200200
"domain": "",
201201
"user": ""
202202
},
203-
"peername": "",
204-
"sockname": ""
203+
"remote": { "ip": "", "port": 1 },
204+
"local": { "ip": "", "port": 1 }
205205
},
206206
"optional_fields": {
207207
}
@@ -221,8 +221,8 @@
221221
"domain": "",
222222
"user": ""
223223
},
224-
"peername": "",
225-
"sockname": ""
224+
"remote": { "ip": "", "port": 1 },
225+
"local": { "ip": "", "port": 1 }
226226
},
227227
"optional_fields": {
228228
}
@@ -242,8 +242,8 @@
242242
"domain": "",
243243
"user": ""
244244
},
245-
"peername": "",
246-
"sockname": ""
245+
"remote": { "ip": "", "port": 1 },
246+
"local": { "ip": "", "port": 1 }
247247
},
248248
"optional_fields": {
249249
}
@@ -261,11 +261,11 @@
261261
"domain": "",
262262
"user": ""
263263
},
264-
"bucket": ""
264+
"bucket": "",
265+
"remote": { "ip": "", "port": 1 },
266+
"local": { "ip": "", "port": 1 }
265267
},
266268
"optional_fields": {
267-
"peername": "",
268-
"sockname": ""
269269
}
270270
},
271271
{
@@ -281,11 +281,11 @@
281281
"real_userid": {
282282
"domain": "",
283283
"user": ""
284-
}
284+
},
285+
"remote": { "ip": "", "port": 1 },
286+
"local": { "ip": "", "port": 1 }
285287
},
286288
"optional_fields": {
287-
"peername": "",
288-
"sockname": ""
289289
}
290290
}
291291
]

‎tests/testapp/testapp_audit.cc‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -468,3 +468,34 @@ TEST_P(AuditTest, MB33603_Filtering) {
468468
EXPECT_FALSE(found)
469469
<< "Filtering out memcached generated events don't work";
470470
}
471+
472+
TEST_P(AuditTest, MB41183_UnifiedConnectionDescription) {
473+
BinprotSaslAuthCommand cmd;
474+
cmd.setChallenge({"\0MB41183\0nopassword", 18});
475+
cmd.setMechanism("PLAIN");
476+
477+
auto rsp = getConnection().execute(cmd);
478+
EXPECT_EQ(cb::mcbp::ClientOpcode::SaslAuth, rsp.getOp());
479+
EXPECT_EQ(cb::mcbp::Status::AuthError, rsp.getStatus());
480+
481+
iterate([](const nlohmann::json& entry) {
482+
if (entry.find("peername") != entry.cend() ||
483+
entry.find("sockname") != entry.cend()) {
484+
throw std::runtime_error(
485+
"FAIL: peername or sockname should not be present: " +
486+
entry.dump());
487+
}
488+
489+
if (entry["id"].get<int>() != MEMCACHED_AUDIT_AUTHENTICATION_FAILED) {
490+
return false;
491+
}
492+
493+
// THe following piece of code will throw exceptions if they don't
494+
// exists or is of wrong type
495+
entry["remote"]["ip"].get<std::string>();
496+
entry["remote"]["port"].get<int>();
497+
entry["local"]["ip"].get<std::string>();
498+
entry["local"]["port"].get<int>();
499+
return true;
500+
});
501+
}

0 commit comments

Comments
 (0)