audit

Documentation

Index

• func Hash(salter *salt.Salt, raw interface{}) error
• func HashString(salter *salt.Salt, data string) string
• func HashStructure(s interface{}, cb HashCallback) (interface{}, error)
• type AuditAuth
• type AuditFormatWriter
• type AuditFormatter
  • func (f *AuditFormatter) FormatRequest(w io.Writer, config FormatterConfig, auth *logical.Auth, req *logical.Request, ...) error
  • func (f *AuditFormatter) FormatResponse(w io.Writer, config FormatterConfig, auth *logical.Auth, req *logical.Request, ...) error
• type AuditRequest
• type AuditRequestEntry
• type AuditResponse
• type AuditResponseEntry
• type AuditResponseWrapInfo
• type AuditSecret
• type Backend
• type BackendConfig
• type Factory
• type Formatter
• type FormatterConfig
• type HashCallback
• type JSONFormatWriter
  • func (f *JSONFormatWriter) WriteRequest(w io.Writer, req *AuditRequestEntry) error
  • func (f *JSONFormatWriter) WriteResponse(w io.Writer, resp *AuditResponseEntry) error
• type JSONxFormatWriter
  • func (f *JSONxFormatWriter) WriteRequest(w io.Writer, req *AuditRequestEntry) error
  • func (f *JSONxFormatWriter) WriteResponse(w io.Writer, resp *AuditResponseEntry) error

Functions

func Hash

func Hash(salter *salt.Salt, raw interface{}) error

Hash will hash the given type. This has built-in support for auth, requests, and responses. If it is a type that isn't recognized, then it will be passed through.

The structure is modified in-place.

func HashString

func HashString(salter *salt.Salt, data string) string

HashString hashes the given opaque string and returns it

func HashStructure

func HashStructure(s interface{}, cb HashCallback) (interface{}, error)

HashStructure takes an interface and hashes all the values within the structure. Only _values_ are hashed: keys of objects are not.

For the HashCallback, see the built-in HashCallbacks below.

Types

type AuditAuth

type AuditAuth struct {
	ClientToken string            `json:"client_token"`
	Accessor    string            `json:"accessor"`
	DisplayName string            `json:"display_name"`
	Policies    []string          `json:"policies"`
	Metadata    map[string]string `json:"metadata"`
}

type AuditFormatWriter

type AuditFormatWriter interface {
	WriteRequest(io.Writer, *AuditRequestEntry) error
	WriteResponse(io.Writer, *AuditResponseEntry) error
}

type AuditFormatter

type AuditFormatter struct {
	AuditFormatWriter
}

AuditFormatter implements the Formatter interface, and allows the underlying marshaller to be swapped out

func (*AuditFormatter) FormatRequest

func (f *AuditFormatter) FormatRequest(
	w io.Writer,
	config FormatterConfig,
	auth *logical.Auth,
	req *logical.Request,
	inErr error) error

func (*AuditFormatter) FormatResponse

func (f *AuditFormatter) FormatResponse(
	w io.Writer,
	config FormatterConfig,
	auth *logical.Auth,
	req *logical.Request,
	resp *logical.Response,
	inErr error) error

type AuditRequest

type AuditRequest struct {
	ID                  string                 `json:"id"`
	ReplicationCluster  string                 `json:"replication_cluster,omitempty"`
	Operation           logical.Operation      `json:"operation"`
	ClientToken         string                 `json:"client_token"`
	ClientTokenAccessor string                 `json:"client_token_accessor"`
	Path                string                 `json:"path"`
	Data                map[string]interface{} `json:"data"`
	RemoteAddr          string                 `json:"remote_address"`
	WrapTTL             int                    `json:"wrap_ttl"`
	Headers             map[string][]string    `json:"headers"`
}

type AuditRequestEntry

type AuditRequestEntry struct {
	Time    string       `json:"time,omitempty"`
	Type    string       `json:"type"`
	Auth    AuditAuth    `json:"auth"`
	Request AuditRequest `json:"request"`
	Error   string       `json:"error"`
}

AuditRequest is the structure of a request audit log entry in Audit.

type AuditResponse

type AuditResponse struct {
	Auth     *AuditAuth             `json:"auth,omitempty"`
	Secret   *AuditSecret           `json:"secret,omitempty"`
	Data     map[string]interface{} `json:"data,omitempty"`
	Redirect string                 `json:"redirect,omitempty"`
	WrapInfo *AuditResponseWrapInfo `json:"wrap_info,omitempty"`
}

type AuditResponseEntry

type AuditResponseEntry struct {
	Time     string        `json:"time,omitempty"`
	Type     string        `json:"type"`
	Auth     AuditAuth     `json:"auth"`
	Request  AuditRequest  `json:"request"`
	Response AuditResponse `json:"response"`
	Error    string        `json:"error"`
}

AuditResponseEntry is the structure of a response audit log entry in Audit.

type AuditResponseWrapInfo

type AuditResponseWrapInfo struct {
	TTL             int    `json:"ttl"`
	Token           string `json:"token"`
	CreationTime    string `json:"creation_time"`
	WrappedAccessor string `json:"wrapped_accessor,omitempty"`
}

type AuditSecret

type AuditSecret struct {
	LeaseID string `json:"lease_id"`
}

type Backend

type Backend interface {
	// LogRequest is used to synchronously log a request. This is done after the
	// request is authorized but before the request is executed. The arguments
	// MUST not be modified in anyway. They should be deep copied if this is
	// a possibility.
	LogRequest(*logical.Auth, *logical.Request, error) error

	// LogResponse is used to synchronously log a response. This is done after
	// the request is processed but before the response is sent. The arguments
	// MUST not be modified in anyway. They should be deep copied if this is
	// a possibility.
	LogResponse(*logical.Auth, *logical.Request, *logical.Response, error) error

	// GetHash is used to return the given data with the backend's hash,
	// so that a caller can determine if a value in the audit log matches
	// an expected plaintext value
	GetHash(string) string

	// Reload is called on SIGHUP for supporting backends.
	Reload() error
}

Backend interface must be implemented for an audit mechanism to be made available. Audit backends can be enabled to sink information to different backends such as logs, file, databases, or other external services.

type BackendConfig

type BackendConfig struct {
	// The salt that should be used for any secret obfuscation
	Salt *salt.Salt

	// Config is the opaque user configuration provided when mounting
	Config map[string]string
}

type Factory

type Factory func(*BackendConfig) (Backend, error)

Factory is the factory function to create an audit backend.

type Formatter

type Formatter interface {
	FormatRequest(io.Writer, FormatterConfig, *logical.Auth, *logical.Request, error) error
	FormatResponse(io.Writer, FormatterConfig, *logical.Auth, *logical.Request, *logical.Response, error) error
}

Formatter is an interface that is responsible for formating a request/response into some format. Formatters write their output to an io.Writer.

It is recommended that you pass data through Hash prior to formatting it.

type FormatterConfig

type FormatterConfig struct {
	Raw          bool
	Salt         *salt.Salt
	HMACAccessor bool

	// This should only ever be used in a testing context
	OmitTime bool
}

type HashCallback

type HashCallback func(string) string

HashCallback is the callback called for HashStructure to hash a value.

type JSONFormatWriter

type JSONFormatWriter struct {
	Prefix string
}

JSONFormatWriter is an AuditFormatWriter implementation that structures data into a JSON format.

func (*JSONFormatWriter) WriteRequest

func (f *JSONFormatWriter) WriteRequest(w io.Writer, req *AuditRequestEntry) error

func (*JSONFormatWriter) WriteResponse

func (f *JSONFormatWriter) WriteResponse(w io.Writer, resp *AuditResponseEntry) error

type JSONxFormatWriter

type JSONxFormatWriter struct {
	Prefix string
}

JSONxFormatWriter is an AuditFormatWriter implementation that structures data into a XML format.

func (*JSONxFormatWriter) WriteRequest

func (f *JSONxFormatWriter) WriteRequest(w io.Writer, req *AuditRequestEntry) error

func (*JSONxFormatWriter) WriteResponse

func (f *JSONxFormatWriter) WriteResponse(w io.Writer, resp *AuditResponseEntry) error