1 /**
2  * Licensed to the Apache Software Foundation (ASF) under one
3  * or more contributor license agreements.  See the NOTICE file
4  * distributed with this work for additional information
5  * regarding copyright ownership.  The ASF licenses this file
6  * to you under the Apache License, Version 2.0 (the
7  * "License"); you may not use this file except in compliance
8  * with the License.  You may obtain a copy of the License at
9  *
10  *     http://www.apache.org/licenses/LICENSE-2.0
11  *
12  * Unless required by applicable law or agreed to in writing, software
13  * distributed under the License is distributed on an "AS IS" BASIS,
14  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15  * See the License for the specific language governing permissions and
16  * limitations under the License.
17  */
18 
19 package org.apache.hadoop.mapreduce.v2.hs;
20 
21 import java.net.InetAddress;
22 
23 import org.apache.commons.logging.Log;
24 import org.apache.commons.logging.LogFactory;
25 import org.apache.hadoop.classification.InterfaceAudience.Private;
26 import org.apache.hadoop.ipc.Server;
27 
28 @Private
29 public class HSAuditLogger {
30   private static final Log LOG = LogFactory.getLog(HSAuditLogger.class);
31 
32   static enum Keys {
33     USER, OPERATION, TARGET, RESULT, IP, PERMISSIONS, DESCRIPTION
34   }
35 
36   public static class AuditConstants {
37     static final String SUCCESS = "SUCCESS";
38     static final String FAILURE = "FAILURE";
39     static final String KEY_VAL_SEPARATOR = "=";
40     static final char PAIR_SEPARATOR = '\t';
41 
42     // Some commonly used descriptions
43     public static final String UNAUTHORIZED_USER = "Unauthorized user";
44   }
45 
46   /**
47    * Create a readable and parseable audit log string for a successful event.
48    *
49    * @param user
50    *          User who made the service request.
51    * @param operation
52    *          Operation requested by the user.
53    * @param target
54    *          The target on which the operation is being performed.
55    *
56    * <br>
57    * <br>
58    *          Note that the {@link HSAuditLogger} uses tabs ('\t') as a key-val
59    *          delimiter and hence the value fields should not contains tabs
60    *          ('\t').
61    */
logSuccess(String user, String operation, String target)62   public static void logSuccess(String user, String operation, String target) {
63     if (LOG.isInfoEnabled()) {
64       LOG.info(createSuccessLog(user, operation, target));
65     }
66   }
67 
68   /**
69    * A helper api for creating an audit log for a successful event.
70    */
createSuccessLog(String user, String operation, String target)71   static String createSuccessLog(String user, String operation, String target) {
72     StringBuilder b = new StringBuilder();
73     start(Keys.USER, user, b);
74     addRemoteIP(b);
75     add(Keys.OPERATION, operation, b);
76     add(Keys.TARGET, target, b);
77     add(Keys.RESULT, AuditConstants.SUCCESS, b);
78     return b.toString();
79   }
80 
81   /**
82    * A helper api to add remote IP address
83    */
addRemoteIP(StringBuilder b)84   static void addRemoteIP(StringBuilder b) {
85     InetAddress ip = Server.getRemoteIp();
86     // ip address can be null for testcases
87     if (ip != null) {
88       add(Keys.IP, ip.getHostAddress(), b);
89     }
90   }
91 
92   /**
93    * Appends the key-val pair to the passed builder in the following format
94    * <pair-delim>key=value
95    */
add(Keys key, String value, StringBuilder b)96   static void add(Keys key, String value, StringBuilder b) {
97     b.append(AuditConstants.PAIR_SEPARATOR).append(key.name())
98         .append(AuditConstants.KEY_VAL_SEPARATOR).append(value);
99   }
100 
101   /**
102    * Adds the first key-val pair to the passed builder in the following format
103    * key=value
104    */
start(Keys key, String value, StringBuilder b)105   static void start(Keys key, String value, StringBuilder b) {
106     b.append(key.name()).append(AuditConstants.KEY_VAL_SEPARATOR).append(value);
107   }
108 
109   /**
110    * Create a readable and parseable audit log string for a failed event.
111    *
112    * @param user
113    *          User who made the service request.
114    * @param operation
115    *          Operation requested by the user.
116    * @param perm
117    *          Target permissions.
118    * @param target
119    *          The target on which the operation is being performed.
120    * @param description
121    *          Some additional information as to why the operation failed.
122    *
123    * <br>
124    * <br>
125    *          Note that the {@link HSAuditLogger} uses tabs ('\t') as a key-val
126    *          delimiter and hence the value fields should not contains tabs
127    *          ('\t').
128    */
logFailure(String user, String operation, String perm, String target, String description)129   public static void logFailure(String user, String operation, String perm,
130       String target, String description) {
131     if (LOG.isWarnEnabled()) {
132       LOG.warn(createFailureLog(user, operation, perm, target, description));
133     }
134   }
135 
136   /**
137    * A helper api for creating an audit log for a failure event.
138    */
createFailureLog(String user, String operation, String perm, String target, String description)139   static String createFailureLog(String user, String operation, String perm,
140       String target, String description) {
141     StringBuilder b = new StringBuilder();
142     start(Keys.USER, user, b);
143     addRemoteIP(b);
144     add(Keys.OPERATION, operation, b);
145     add(Keys.TARGET, target, b);
146     add(Keys.RESULT, AuditConstants.FAILURE, b);
147     add(Keys.DESCRIPTION, description, b);
148     add(Keys.PERMISSIONS, perm, b);
149 
150     return b.toString();
151   }
152 }
153