17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*dfc7be02SJan Friedel * Common Development and Distribution License (the "License").
6*dfc7be02SJan Friedel * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*dfc7be02SJan Friedel * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23*dfc7be02SJan Friedel * Use is subject to license terms.
24*dfc7be02SJan Friedel *
257c478bd9Sstevel@tonic-gate */
267c478bd9Sstevel@tonic-gate
277c478bd9Sstevel@tonic-gate #include <sys/types.h>
287c478bd9Sstevel@tonic-gate #include <stdio.h>
297c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
307c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
317c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
327c478bd9Sstevel@tonic-gate #include <bsm/audit_uevents.h>
337c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
347c478bd9Sstevel@tonic-gate #include <stdlib.h>
357c478bd9Sstevel@tonic-gate #include <string.h>
367c478bd9Sstevel@tonic-gate #include <syslog.h>
377c478bd9Sstevel@tonic-gate #include <netinet/in.h>
387c478bd9Sstevel@tonic-gate #include <unistd.h>
397c478bd9Sstevel@tonic-gate #include <generic.h>
407c478bd9Sstevel@tonic-gate
417c478bd9Sstevel@tonic-gate #ifdef C2_DEBUG2
42*dfc7be02SJan Friedel #define dprintf(x) { (void) printf x; }
437c478bd9Sstevel@tonic-gate #else
447c478bd9Sstevel@tonic-gate #define dprintf(x)
457c478bd9Sstevel@tonic-gate #endif
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate #define AUD_NULL_STR(s) ((s) ? (s) : "(null)")
487c478bd9Sstevel@tonic-gate
497c478bd9Sstevel@tonic-gate void
audit_krb5kdc_setup()507c478bd9Sstevel@tonic-gate audit_krb5kdc_setup()
517c478bd9Sstevel@tonic-gate {
527c478bd9Sstevel@tonic-gate dprintf(("audit_krb5kdc_setup()\n"));
537c478bd9Sstevel@tonic-gate
547c478bd9Sstevel@tonic-gate }
557c478bd9Sstevel@tonic-gate
567c478bd9Sstevel@tonic-gate static void
common_audit(au_event_t event,struct in_addr * r_addr,in_port_t r_port,in_port_t l_port,char * cname,char * sname,int sorf)577c478bd9Sstevel@tonic-gate common_audit(
587c478bd9Sstevel@tonic-gate au_event_t event, /* audit event */
597c478bd9Sstevel@tonic-gate struct in_addr *r_addr, /* remote ipv4 addr */
607c478bd9Sstevel@tonic-gate in_port_t r_port, /* remote port */
617c478bd9Sstevel@tonic-gate in_port_t l_port, /* local port */
627c478bd9Sstevel@tonic-gate char *cname, /* client principal name */
637c478bd9Sstevel@tonic-gate char *sname, /* requested service name */
647c478bd9Sstevel@tonic-gate int sorf) /* flag for success or failure */
657c478bd9Sstevel@tonic-gate {
667c478bd9Sstevel@tonic-gate auditinfo_t ai;
677c478bd9Sstevel@tonic-gate dev_t port = 0;
687c478bd9Sstevel@tonic-gate uint32_t machine;
697c478bd9Sstevel@tonic-gate char text_buf[512];
707c478bd9Sstevel@tonic-gate
717c478bd9Sstevel@tonic-gate dprintf(("common_audit() start\n"));
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate /* if auditing turned off, then don't do anything */
747c478bd9Sstevel@tonic-gate if (cannot_audit(0))
757c478bd9Sstevel@tonic-gate return;
767c478bd9Sstevel@tonic-gate
777c478bd9Sstevel@tonic-gate (void) aug_save_namask();
787c478bd9Sstevel@tonic-gate
797c478bd9Sstevel@tonic-gate if (getaudit(&ai)) {
807c478bd9Sstevel@tonic-gate perror("krb5kdc");
817c478bd9Sstevel@tonic-gate return;
827c478bd9Sstevel@tonic-gate }
837c478bd9Sstevel@tonic-gate aug_save_auid(ai.ai_auid); /* Audit ID */
847c478bd9Sstevel@tonic-gate aug_save_uid(getuid()); /* User ID */
857c478bd9Sstevel@tonic-gate aug_save_euid(geteuid()); /* Effective User ID */
867c478bd9Sstevel@tonic-gate aug_save_gid(getgid()); /* Group ID */
877c478bd9Sstevel@tonic-gate aug_save_egid(getegid()); /* Effective Group ID */
887c478bd9Sstevel@tonic-gate aug_save_pid(getpid()); /* process ID */
897c478bd9Sstevel@tonic-gate aug_save_asid(getpid()); /* session ID */
907c478bd9Sstevel@tonic-gate
917c478bd9Sstevel@tonic-gate aug_save_event(event);
927c478bd9Sstevel@tonic-gate aug_save_sorf(sorf);
937c478bd9Sstevel@tonic-gate
947c478bd9Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Client: %s",
957c478bd9Sstevel@tonic-gate AUD_NULL_STR(cname));
967c478bd9Sstevel@tonic-gate aug_save_text1(text_buf);
977c478bd9Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Service: %s",
987c478bd9Sstevel@tonic-gate AUD_NULL_STR(sname));
997c478bd9Sstevel@tonic-gate aug_save_text2(text_buf);
1007c478bd9Sstevel@tonic-gate
1017c478bd9Sstevel@tonic-gate dprintf(("audit_krb5kdc: r_port=%d, l_port=%d\n", r_port, l_port));
1027c478bd9Sstevel@tonic-gate port = (htons(r_port)<<16 | htons(l_port));
1037c478bd9Sstevel@tonic-gate
1047c478bd9Sstevel@tonic-gate machine = r_addr ? (uint32_t)r_addr->s_addr : 0;
1057c478bd9Sstevel@tonic-gate
1067c478bd9Sstevel@tonic-gate aug_save_tid_ex(port, &machine, AU_IPv4);
1077c478bd9Sstevel@tonic-gate
1087c478bd9Sstevel@tonic-gate (void) aug_audit();
1097c478bd9Sstevel@tonic-gate }
1107c478bd9Sstevel@tonic-gate
1117c478bd9Sstevel@tonic-gate void
audit_krb5kdc_as_req(struct in_addr * r_addr,in_port_t r_port,in_port_t l_port,char * cname,char * sname,int sorf)1127c478bd9Sstevel@tonic-gate audit_krb5kdc_as_req(
1137c478bd9Sstevel@tonic-gate struct in_addr *r_addr, /* remote ipv4 addr */
1147c478bd9Sstevel@tonic-gate in_port_t r_port, /* remote port */
1157c478bd9Sstevel@tonic-gate in_port_t l_port, /* local port */
1167c478bd9Sstevel@tonic-gate char *cname, /* client principal name */
1177c478bd9Sstevel@tonic-gate char *sname, /* requested service name */
1187c478bd9Sstevel@tonic-gate int sorf) /* flag for success or failure */
1197c478bd9Sstevel@tonic-gate {
1207c478bd9Sstevel@tonic-gate common_audit(AUE_krb5kdc_as_req, r_addr, r_port, l_port, cname,
1217c478bd9Sstevel@tonic-gate sname, sorf);
1227c478bd9Sstevel@tonic-gate }
1237c478bd9Sstevel@tonic-gate
1247c478bd9Sstevel@tonic-gate void
audit_krb5kdc_tgs_req(struct in_addr * r_addr,in_port_t r_port,in_port_t l_port,char * cname,char * sname,int sorf)1257c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req(
1267c478bd9Sstevel@tonic-gate struct in_addr *r_addr, /* remote ipv4 addr */
1277c478bd9Sstevel@tonic-gate in_port_t r_port, /* remote port */
1287c478bd9Sstevel@tonic-gate in_port_t l_port, /* local port */
1297c478bd9Sstevel@tonic-gate char *cname, /* client principal name */
1307c478bd9Sstevel@tonic-gate char *sname, /* requested service name */
1317c478bd9Sstevel@tonic-gate int sorf) /* flag for success or failure */
1327c478bd9Sstevel@tonic-gate {
1337c478bd9Sstevel@tonic-gate common_audit(AUE_krb5kdc_tgs_req, r_addr, r_port, l_port, cname,
1347c478bd9Sstevel@tonic-gate sname, sorf);
1357c478bd9Sstevel@tonic-gate }
1367c478bd9Sstevel@tonic-gate
1377c478bd9Sstevel@tonic-gate void
audit_krb5kdc_tgs_req_2ndtktmm(struct in_addr * r_addr,in_port_t r_port,in_port_t l_port,char * cname,char * sname)1387c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_2ndtktmm(
1397c478bd9Sstevel@tonic-gate struct in_addr *r_addr, /* remote ipv4 addr */
1407c478bd9Sstevel@tonic-gate in_port_t r_port, /* remote port */
1417c478bd9Sstevel@tonic-gate in_port_t l_port, /* local port */
1427c478bd9Sstevel@tonic-gate char *cname, /* client principal name */
1437c478bd9Sstevel@tonic-gate char *sname) /* requested service name */
1447c478bd9Sstevel@tonic-gate {
1457c478bd9Sstevel@tonic-gate common_audit(AUE_krb5kdc_tgs_req_2ndtktmm, r_addr, r_port, l_port,
1467c478bd9Sstevel@tonic-gate cname, sname, 1);
1477c478bd9Sstevel@tonic-gate }
1487c478bd9Sstevel@tonic-gate
1497c478bd9Sstevel@tonic-gate void
audit_krb5kdc_tgs_req_alt_tgt(struct in_addr * r_addr,in_port_t r_port,in_port_t l_port,char * cname,char * sname,int sorf)1507c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_alt_tgt(
1517c478bd9Sstevel@tonic-gate struct in_addr *r_addr, /* remote ipv4 addr */
1527c478bd9Sstevel@tonic-gate in_port_t r_port, /* remote port */
1537c478bd9Sstevel@tonic-gate in_port_t l_port, /* local port */
1547c478bd9Sstevel@tonic-gate char *cname, /* client principal name */
1557c478bd9Sstevel@tonic-gate char *sname, /* requested service name */
1567c478bd9Sstevel@tonic-gate int sorf) /* flag for success or failure */
1577c478bd9Sstevel@tonic-gate {
1587c478bd9Sstevel@tonic-gate common_audit(AUE_krb5kdc_tgs_req_alt_tgt, r_addr, r_port, l_port,
1597c478bd9Sstevel@tonic-gate cname, sname, sorf);
1607c478bd9Sstevel@tonic-gate }
161