1 /** 2 * Licensed to the Apache Software Foundation (ASF) under one 3 * or more contributor license agreements. See the NOTICE file 4 * distributed with this work for additional information 5 * regarding copyright ownership. The ASF licenses this file 6 * to you under the Apache License, Version 2.0 (the 7 * "License"); you may not use this file except in compliance 8 * with the License. You may obtain a copy of the License at 9 * 10 * http://www.apache.org/licenses/LICENSE-2.0 11 * 12 * Unless required by applicable law or agreed to in writing, software 13 * distributed under the License is distributed on an "AS IS" BASIS, 14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 15 * See the License for the specific language governing permissions and 16 * limitations under the License. 17 */ 18 19 package org.apache.hadoop.mapreduce.v2.hs; 20 21 import java.net.InetAddress; 22 23 import org.apache.commons.logging.Log; 24 import org.apache.commons.logging.LogFactory; 25 import org.apache.hadoop.classification.InterfaceAudience.Private; 26 import org.apache.hadoop.ipc.Server; 27 28 @Private 29 public class HSAuditLogger { 30 private static final Log LOG = LogFactory.getLog(HSAuditLogger.class); 31 32 static enum Keys { 33 USER, OPERATION, TARGET, RESULT, IP, PERMISSIONS, DESCRIPTION 34 } 35 36 public static class AuditConstants { 37 static final String SUCCESS = "SUCCESS"; 38 static final String FAILURE = "FAILURE"; 39 static final String KEY_VAL_SEPARATOR = "="; 40 static final char PAIR_SEPARATOR = '\t'; 41 42 // Some commonly used descriptions 43 public static final String UNAUTHORIZED_USER = "Unauthorized user"; 44 } 45 46 /** 47 * Create a readable and parseable audit log string for a successful event. 48 * 49 * @param user 50 * User who made the service request. 51 * @param operation 52 * Operation requested by the user. 53 * @param target 54 * The target on which the operation is being performed. 55 * 56 * <br> 57 * <br> 58 * Note that the {@link HSAuditLogger} uses tabs ('\t') as a key-val 59 * delimiter and hence the value fields should not contains tabs 60 * ('\t'). 61 */ logSuccess(String user, String operation, String target)62 public static void logSuccess(String user, String operation, String target) { 63 if (LOG.isInfoEnabled()) { 64 LOG.info(createSuccessLog(user, operation, target)); 65 } 66 } 67 68 /** 69 * A helper api for creating an audit log for a successful event. 70 */ createSuccessLog(String user, String operation, String target)71 static String createSuccessLog(String user, String operation, String target) { 72 StringBuilder b = new StringBuilder(); 73 start(Keys.USER, user, b); 74 addRemoteIP(b); 75 add(Keys.OPERATION, operation, b); 76 add(Keys.TARGET, target, b); 77 add(Keys.RESULT, AuditConstants.SUCCESS, b); 78 return b.toString(); 79 } 80 81 /** 82 * A helper api to add remote IP address 83 */ addRemoteIP(StringBuilder b)84 static void addRemoteIP(StringBuilder b) { 85 InetAddress ip = Server.getRemoteIp(); 86 // ip address can be null for testcases 87 if (ip != null) { 88 add(Keys.IP, ip.getHostAddress(), b); 89 } 90 } 91 92 /** 93 * Appends the key-val pair to the passed builder in the following format 94 * <pair-delim>key=value 95 */ add(Keys key, String value, StringBuilder b)96 static void add(Keys key, String value, StringBuilder b) { 97 b.append(AuditConstants.PAIR_SEPARATOR).append(key.name()) 98 .append(AuditConstants.KEY_VAL_SEPARATOR).append(value); 99 } 100 101 /** 102 * Adds the first key-val pair to the passed builder in the following format 103 * key=value 104 */ start(Keys key, String value, StringBuilder b)105 static void start(Keys key, String value, StringBuilder b) { 106 b.append(key.name()).append(AuditConstants.KEY_VAL_SEPARATOR).append(value); 107 } 108 109 /** 110 * Create a readable and parseable audit log string for a failed event. 111 * 112 * @param user 113 * User who made the service request. 114 * @param operation 115 * Operation requested by the user. 116 * @param perm 117 * Target permissions. 118 * @param target 119 * The target on which the operation is being performed. 120 * @param description 121 * Some additional information as to why the operation failed. 122 * 123 * <br> 124 * <br> 125 * Note that the {@link HSAuditLogger} uses tabs ('\t') as a key-val 126 * delimiter and hence the value fields should not contains tabs 127 * ('\t'). 128 */ logFailure(String user, String operation, String perm, String target, String description)129 public static void logFailure(String user, String operation, String perm, 130 String target, String description) { 131 if (LOG.isWarnEnabled()) { 132 LOG.warn(createFailureLog(user, operation, perm, target, description)); 133 } 134 } 135 136 /** 137 * A helper api for creating an audit log for a failure event. 138 */ createFailureLog(String user, String operation, String perm, String target, String description)139 static String createFailureLog(String user, String operation, String perm, 140 String target, String description) { 141 StringBuilder b = new StringBuilder(); 142 start(Keys.USER, user, b); 143 addRemoteIP(b); 144 add(Keys.OPERATION, operation, b); 145 add(Keys.TARGET, target, b); 146 add(Keys.RESULT, AuditConstants.FAILURE, b); 147 add(Keys.DESCRIPTION, description, b); 148 add(Keys.PERMISSIONS, perm, b); 149 150 return b.toString(); 151 } 152 } 153